Both layers let you slow updates on purpose. Windows Update client policies offer deferrals and pauses, and dependency bots offer cooldowns, schedules and pull request limits. Use them to buy testing time on routine updates, and keep them out of the way of security fixes.
The controls compared
| Control | Windows Update client policies | Dependabot configuration |
|---|---|---|
| Delay a release | Defer quality updates up to 30 days, feature updates up to 365 days | cooldown with default and per semver days |
| Stop temporarily | Pause for 35 days from a start date | Set open-pull-requests-limit to zero to disable version updates |
| Set rhythm | Deadlines and grace periods | schedule.interval: daily, weekly, monthly and others |
| Limit noise | Deployment in waves | groups and a default limit of five open version update PRs |
| Security exemption | Nondeferrable updates have no deferral | Cooldown applies only to version updates, not security updates |
Figures come from the vendor documentation listed below. Check current docs before you rely on them, since they change.
What the Windows controls are for
Microsoft describes deferrals as a way to allow time to validate deployments, and pause as a response to a problem found during rollout. If you pause a feature update, quality updates are still offered so devices stay secure. Compliance deadlines then force installation after a set number of days, with a grace period before restart.
What the dependency bot controls are for
A cooldown waits a set number of days before applying new version updates, and the GitHub documentation states a three day default applies even when you do not configure it. Security updates are separate: they are triggered by alerts, and the security pull request limit is a fixed 10 that the version updates option does not change.
Using both well
- Delay routine, never security. Deferral is for feature and routine changes. Know which of your updates the delay applies to.
- Set a hard stop. NIST advises offering flexibility on routine patches while forcing installation after a grace period. Treat every delay as expiring.
- Use pause for incidents. If an update breaks something, pause, investigate, then resume with a note.
- Group to reduce fatigue. Grouping dependency updates by rule turns many pull requests into a few. See grouped Dependabot pull requests.
- Review the settings quarterly. Old pauses and zero limits get forgotten.
The risk of too much delay
NIST warns that postponed routine patching leaves more windows for attackers and makes later emergency patching harder because earlier patches are prerequisites. Delay buys testing time, so spend it on testing, and do not let it turn into neglect.
Where Safeguard fits
Safeguard's policies and gates let you set rules on what may merge, so a delay on routine updates does not become a delay on known vulnerable versions. Free scan: gold.safeguard.sh/scan.
Quick check
Does a cooldown delay security fixes?
In Dependabot, the cooldown applies to version updates, not security updates, per the GitHub documentation.
Can I pause Windows updates indefinitely?
Documentation gives a 35 day pause from a start date. Plan for the pause to end.
Sources
- Microsoft Learn: Windows Update client policies
- GitHub Docs: Dependabot configuration options
- NIST SP 800-40 Rev. 4 full text
Last reviewed: 19 October 2026.
