Dependabot's cooldown setting makes it wait a set number of days after a release before opening a version update pull request. It applies to version updates, not security updates. You can set a default, separate delays by SemVer level for supported package managers, and include or exclude named dependencies.
Why delay at all
A brand new release has had little time in the wild. Problems such as a broken build, a bad publish or a hijacked package are often noticed within days. Waiting a short period lets others find those problems first. The cost is that you run slightly older versions for a little longer.
The options
From GitHub's reference for Dependabot options:
default-daysis the cooldown for dependencies without a more specific rule.semver-major-days,semver-minor-daysandsemver-patch-daysset separate delays by SemVer level, for supported package managers only.includelists the dependencies the cooldown applies to, up to 150, with wildcards allowed.excludelists dependencies exempt from cooldown, up to 150, wildcards allowed. It takes precedence overinclude, so excluded dependencies update immediately.
The reference states that cooldown applies to version updates only, not to security updates.
A sample setup
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 5
semver-major-days: 14
Check GitHub's current reference for exact syntax and defaults before you copy this, since options change.
Choosing numbers
A longer delay for major versions makes sense because they carry breaking changes. A short one for patch releases keeps you close to fixes. Pick values your team can defend, and review them after a few months of data.
Keep security updates fast
Cooldown does not apply to security updates, which is what you want. A fix for a known flaw should not wait. Make sure your security updates are enabled, and that someone owns the pull requests. See Dependabot alerts: small team triage.
Exceptions for trusted packages
Use exclude for your own internal packages, which you release and trust. There is no reason to delay your own work.
What cooldown does not do
It is not a malware filter. A malicious release that stays undetected past your delay will still arrive. Combine it with other controls such as lockfiles, review of new dependencies and monitoring of maintainer changes.
Safeguard's SBOM and dependency scanning, plus policies and gates, can add checks around what gets merged, and you can try a free scan.
Rolling it out
Start with a small number of repositories and a modest default. Watch how many pull requests arrive late, and whether anyone complains about missing a release they needed. If a team needs a specific package sooner, add it to exclude rather than shortening the default for everything.
Write the reason for each exclusion in the configuration file as a comment, so the next person knows why it is there. Review the list every quarter, because packages you once trusted may no longer deserve it.
Quick check
Does cooldown delay security updates?
No. It applies to version updates only.
Which setting wins if a package is in include and exclude?
Exclude takes precedence, so that dependency updates immediately.
Sources
Last reviewed: 19 October 2026.
