Dependabot learns to wait: version-update PRs now sit for three days by default

Short summary

GitHub changed Dependabot's default behavior on 2026-07-14: version-update PRs now wait three days after a package is published before opening. Security updates are exempt and still fire immediately. The cooldown is on by default across all ecosystems, applies to GHES 3.23, and existing dependabot.yml cooldown configs take precedence. Teams should update runbooks that assume Dependabot PRs mirror upstream releases in real time.

• •Dependabot version-update PRs now default to a 3-day cooldown after package publication
• •Security updates remain exempt and fire immediately on vulnerability discovery
• •Existing dependabot.yml cooldown configs override the new default; teams should update CI runbooks expecting real-time PRs

Generated with AI, which can make mistakes.