---
id: 20260724-T0-12
title: "Dependabot新增3天冷却期，延迟版本更新PR防止安全漏洞"
title_en: "Dependabot Adds 3-Day Cooldown to Delay Version Updates for Security"
url: https://ai.daily.yangsir.net/daily/20260724-T0-12
issue_date: 2026-07-24
publish_date: 2026-07-23T16:00:00.000Z
category: tools
source_name: "GitHub Blog"
source_url: https://github.blog/security/supply-chain-security/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates/
---

# Dependabot新增3天冷却期，延迟版本更新PR防止安全漏洞

GitHub宣布Dependabot默认新增3天冷却期，延迟版本更新拉取请求的发布。该机制让维护者和安全研究人员在版本更新进入你的代码前，有足够时间处理发现的问题，避免紧急修复被直接注入生产环境。

## English Version

**Dependabot Adds 3-Day Cooldown to Delay Version Updates for Security**

GitHub introduces a default 3-day cooldown for Dependabot version update pull requests, giving maintainers and security researchers time to address findings before the update enters your codebase.

---

**来源**：[GitHub Blog](https://github.blog/security/supply-chain-security/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates/)

**详情页**：https://ai.daily.yangsir.net/daily/20260724-T0-12

---

*智语观潮 · Daily — https://ai.daily.yangsir.net/llms.txt*