Dependabot Adds Default Three-Day Cooldown for Version Updates
Dependabot version updates introduce default package cooldown
We are introducing a default three-day cooldown for Dependabot version updates to help prevent supply chain attacks. This delay allows time for the community to identify compromised releases before they reach your projects. Critical security updates remain immediate, and you can easily customize or disable this setting in your configuration file to maintain full control.
New releases are a common entry point for supply chain attacks where a compromised or broken version can reach your dependency updates before maintainers and the community have caught it.
- zihotki
If everyone starts applying cooldowns, won't it postpone the problem? So now there is a considerable amount of users who are affected and someone from the affected group discovers the infection and reports it.
But if everyone will be delaying updates, won't be there less chances to catch it in time? I'm not fully sure if it's possible to preventively scan all NPM packages or how much compute it would require.
- noosphr
Watching language package managers reinvent everything distribution package managers have been doing since the 90s has been as fun as watching crypto people reinvent financial regulation.
- Waterluvian
I really hate dependabot making generic security people at work so pushy about updates updates updates. They seem to just be dogmatic about whatever dependabot says, forcing churn even when the documented issues are clearly not relevant. I’m not sure how to handle it politically. I’m convinced that updating so much more often is worse, not better.
- ashu1461
This makes me think whether npm (and other registries) should apply security requirements based on ecosystem impact. Example a package having millions of downloads can have special security measures enforced.
- mook
But updates to broken packages are still allowed: if a new version is pushed within the three days, it does not reset the cool-down. You just get a pull request to update to a known-bad version instead.
- 0xbadcafebee
> Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request
So you exploit on Tuesday 12pm, dependabot opens a PR on Friday 12pm, people merge it, and your trojan's timer is set to go off over the weekend when nobody is patching.
- jorisw
Ways to configure 'dependency version cooldowns' into your project with npm, pnpm, yarn:
https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e...
- Grokify
This seems to be primarily an issue with a few specific package management solutions that have suffered SCA vulnerabilities recently, not generaly across the board.