Use Dependabot's default cooldown before merging fresh package releases

GitHub has changed Dependabot version updates so new package releases must sit in the registry for at least three days before Dependabot opens a version-update pull request. Security updates still open immediately.

Use this as a low-friction supply-chain safety check. The default gives maintainers and the wider ecosystem time to flag compromised, yanked, or broken releases before they land in routine dependency-update PRs.

What to do

• Leave the new default in place for most repositories.
• Keep security updates immediate; the cooldown applies to version updates, not urgent security fixes.
• Override the window in .github/dependabot.yml only when your release process has a clear reason.
• Watch high-risk ecosystems or critical services for packages that should use a longer cooldown.

Best fit