The original title is "Dependabot's Three-Day Cooldown Needs an Explicit Exception Policy"

Short summary

GitHub's Dependabot now enforces a three-day cooldown before opening version-update PRs by default. The author provides a decision framework with scoring dimensions—blast radius, release volatility, test strength, rollback speed, and cost of waiting—to evaluate when to override the default. Exceptions should be documented as reviewable organizational metadata with owners and expiration dates.

• •Dependabot's 3-day cooldown is now default; teams need explicit exception policies
• •Decision table scores blast radius, volatility, test strength, rollback speed, and wait cost
• •Exceptions should be reviewable metadata with owners and expiry dates, not silent config changes

Generated with AI, which can make mistakes.