GitHub Dependabot 默认引入三天依赖冷却期
Quoting GitHub Changeling
GitHub把Dependabot的依赖更新加了三天冷静期，默认开启，防止新版本刚出就炸雷，很实用。
GitHub 的 Dependabot 现在默认在检测到新版本发布后，会等待至少三天才创建版本更新 PR。这一冷却机制无需手动配置，对已有项目自动生效。
它帮助团队避免因过早更新引入未稳定的依赖版本，降低安全与兼容性风险。这也是 GitHub 对依赖管理实践的重要改进。
Quoting GitHub Changeling
Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration. — GitHub Changeling , embracing dependency cooldowns Tags: dependency-cooldowns , packaging , security , github
This report is categorized under AITOP's "Products" desk. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include Dependabot, GitHub, 依赖管理, 安全.
Source attribution: curated from Simon Willison’s Weblog.
