Quoting GitHub Changelog
- ID
- 4744
- Status
- summarized
- Published
- 15 Jul 2026, 6:43 AM
- Fetched
- 15 Jul 2026, 11:25 PM
- Provider
- Simon Willison
- Category
- developer-ai
- Original URL
- https://simonwillison.net/2026/Jul/14/github-changeling/
- Source URL
- https://simonwillison.net/atom/everything/
Summary
- Score
- 6.5
- Created
- 15 Jul 2026, 11:26 PM
- Tags
- Audience
- developersvibe_codersdatabase_learners
What happened
GitHub's Dependabot now defaults to a three-day cooldown before opening version update pull requests, meaning it waits until a new release has been on its registry for at least three days. This requires no configuration and is now the default behavior.
Why it matters
For Malaysian dev teams and solo builders relying on GitHub for dependency management, this reduces noise from rushed updates and lowers the risk of pulling in broken or yanked packages. It's a small but meaningful default change that improves supply-chain hygiene without extra setup.
Discussion angle
How this default cooldown changes team workflows—fewer premature PRs to review—and whether three days is the right balance between freshness and stability for different package ecosystems.