Slow routine version updates with a longer schedule interval, a cooldown and a low open pull request limit, but keep vulnerability alerts on. A release freeze should hold back feature-level churn, not security fixes. Write the freeze dates down and plan a catch-up week after launch.
What a freeze should and should not cover
Launch week is a bad time to take a major framework upgrade. It is a worse time to ignore an exploited vulnerability in the framework you ship. Split the two: pause version updates, which are about staying current, and keep security alerts and updates, which are about known flaws.
The controls Dependabot gives you
GitHub's options reference lists these in dependabot.yml:
| Option | Effect |
|---|---|
| schedule.interval | daily, weekly, monthly, quarterly, semiannually, yearly or cron |
| cooldown | Delay pull requests for new releases, with default-days and per-level days for major, minor and patch |
| open-pull-requests-limit | Maximum open version update pull requests, default five |
| groups | Combine updates into fewer pull requests |
By default new versions already wait three days after release before a pull request is raised, which helps avoid freshly published problems.
An example freeze configuration
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 2
cooldown:
default-days: 14
Treat this as a pattern to adapt and check against the current reference, because option support evolves. Security updates are configured separately and are not suppressed by the version update schedule, but verify that behaviour in your own repository before you rely on it.
A simple freeze plan
- Two weeks before launch, merge what is pending and green.
- Switch the schedule to monthly and lower the limit.
- During the freeze, review security alerts as normal.
- After launch, restore the schedule and spend an afternoon on the backlog.
- Record the freeze dates in your register so a reviewer sees it was deliberate.
Do not let the freeze become permanent
Teams that freeze for convenience often stay frozen. Set a calendar reminder for the end date. The longer you wait, the bigger the catch-up, and large jumps hide more breaking changes.
Quick check
Can I pause Dependabot entirely?
You can, but you lose alerts if you disable them. Prefer slowing version updates and leaving alerts on.
Is a cooldown safer?
It delays adoption of brand new releases, which gives time for problems to surface. It does not remove the need to read what you merge.
Safeguard policy gates can hold a pull request that adds a risky dependency during a freeze, and the free scan is at gold.safeguard.sh/scan.
Sources
- GitHub Docs, Dependabot options reference
- GitHub Docs, about Dependabot version updates
- GitHub Docs, about Dependabot security updates
Last reviewed: 19 October 2026.
