GitHub projects mostly use simple delays for Dependabot cooldown
An Exploratory Study of Dependabot Cooldown Adoption in Open-Source GitHub Projects
Software Engineering
Summary
Updating software packages automatically can sometimes spread bad updates too quickly. The authors looked at how popular GitHub projects use a feature called Dependabot cooldown, which slows down automatic updates to give people more time to check for problems. They found most projects used the default pause time of seven days instead of customizing settings. This shows that simple default options are usually preferred over complicated controls when protecting software.
What this means in practice
- •For open source maintainers: Help set up Dependabot cooldown defaults that balance security and convenience based on common usage patterns.
- •For software security teams: Design update policies that focus on general delay intervals rather than complex per-package controls to simplify defenses.
Authors
Hidetake Tanaka, Rikuto Tsuchida, Kazumasa Shimari, Raula Gaikovina Kula, Kenichi Matsumoto
Abstract
Automated dependency updates can rapidly propagate malicious package releases before maintainers and the broader community have enough time to detect them. In July 2025, GitHub made Dependabot cooldown generally available as a defense against software supply chain attacks. However, the effects of its early adoption remain unknown. In this exploratory study, we empirically examine how popular open-source GitHub repositories adopt and configure the feature and investigate their motivations. We find that security concerns motivated 83 of 92 adoption events with known motivations. Security linter warnings triggered 43 of 75 security-only adoptions. Among 251 ecosystems within repositories that retained cooldown, 97.2% set a general delay. Of these, 64.3% used seven days, while use of each update type setting was below 10%. Early adopters therefore favor simple default delays over fine-grained controls. These findings suggest that tools could provide robust defaults reflecting ecosystem support and reserve fine-grained controls for dependencies with clear update priorities.