Quoting GitHub Changeling

GitHub has announced a significant change to Dependabot's behavior, implementing an automatic three-day waiting period before opening version update pull requests. This new default setting aims to improve the stability and reliability of dependency management workflows across thousands of development teams worldwide.

Starting immediately, Dependabot will no longer automatically create pull requests for new package releases the moment they become available. Instead, the tool now enforces a mandatory three-day cooldown period after a release appears on its registry. This means developers will have additional time to observe whether new versions introduce critical bugs, security issues, or compatibility problems before their projects automatically prompt updates. The three-day window has been established as the new default configuration, eliminating the need for manual setup or customization to enable this safety feature.

• Reduced Risk of Broken Builds: The cooldown period allows time for community feedback and bug reports to surface before automated updates reach production codebases
• Lower False-Positive Issues: Teams can avoid wasting time on pull requests that may be reverted shortly after release due to undiscovered defects
• Improved Release Stability: Package maintainers benefit from a natural testing period where early adopters can identify problems
• Streamlined Development Workflows: Developers face fewer dependency update interruptions, allowing better focus on feature development and planned maintenance windows
• No Configuration Required: The default implementation means all GitHub users automatically benefit without manual intervention

This change reflects GitHub's commitment to balancing automation with stability. The three-day cooldown represents a practical compromise between staying current with security patches and avoiding premature adoption of potentially problematic releases. For organizations managing multiple repositories or critical infrastructure, this default behavior significantly reduces operational risk associated with rapid dependency cycles. By making this feature default rather than optional, GitHub ensures that even teams unfamiliar with dependency best practices receive protection automatically, ultimately strengthening the broader ecosystem's resilience and reliability.