GitHub and PyPI both introduced time-based security measures this month that deliberately slow down the software supply chain. The idea is simple: make it harder for attackers to push malicious packages into your dependencies before anyone notices.
Dependabot now has a default three-day cooldown before opening version update pull requests. PyPI will reject new file uploads to any release older than 14 days. Two different mechanisms, same goal: build a window for detection before adoption.
How the Dependabot cooldown works
Previously, Dependabot opened a version update PR within hours of a new package version being published. If an attacker published a malicious version of a popular package, automated dependency bots would spread it across thousands of repositories before anyone had time to react. The three-day cooldown changes that by delaying the PR until the new version has been available on its registry for at least 72 hours.
The cooldown is now the default for all Dependabot version updates. You do not need to configure anything. If you want to override it, there is a configuration option, but GitHub recommends keeping the default. The company’s blog post on the change makes the case plainly: “a new default three-day cooldown delays version update pull requests so maintainers and security researchers can address findings in a release before it gets into your code.”
This is not a complete solution. A three-day window is not enough to detect every malicious package. But it is enough to catch the fast-moving attacks where a package is published, used by automated dependency bots, and then removed before anyone investigates. Those attacks were the ones that the previous instant-update model was most vulnerable to.
PyPI’s 14-day upload freeze
PyPI’s change addresses a different attack vector. If an attacker compromises a maintainer’s account or publishing token, they can upload a new file to an existing, trusted release. The package name and version number look legitimate because they are. The malicious file is just a new upload to the same release.
PyPI now rejects new files uploaded to releases older than 14 days. Once a release has been published for two weeks, no new files can be added to it. This means an attacker who compromises a maintainer’s account cannot go back and poison an old, widely trusted release. They can only publish new versions, which are easier to spot because they are new.
The Python Package Index team wrote that the restriction was “put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised.” That is the right threat model. The most dangerous supply chain attacks are the ones where the malicious package looks exactly like a legitimate one, because it is uploaded to the same release page with the same version number.
Why time-based defenses work
Software supply chain attacks follow a predictable pattern. The attacker publishes a malicious package, it gets adopted by automated tools, and by the time the community detects and removes it, the damage is done. The window between publication and detection is usually hours to days. Time-based defenses exploit that pattern by ensuring that the adoption window does not open until the detection window has had a chance to close.
This is not a new idea. The npm registry has had a similar policy for years, and the Go module proxy introduced a two-day latency window for new modules. What is notable is that GitHub and PyPI are now applying the same logic to package updates, not just new packages. The attack surface for supply chain compromise is shifting from “create a new malicious package” to “compromise an existing trusted package and push a malicious update.” Time-based defenses are the most practical way to address that shift without breaking the development workflow.
Practical implications for developers
For most projects, the Dependabot cooldown is invisible. You will see the same version update PRs, just three days later than before. If you are maintaining a security-critical library that needs immediate updates, you can configure the cooldown per repository. But for the vast majority of dependencies, waiting three days is the safer choice.
The PyPI change is also invisible to consumers. You will not notice that old releases cannot accept new files because you should not be uploading to old releases in the first place. If you maintain a Python package, make sure your publishing workflow creates a new release for each update. Trying to patch an old release with a new file after 14 days will fail.
There is a broader takeaway here. The security community is converging on time-based defenses as a practical tool against supply chain attacks. Cooldowns, upload freezes, and latency windows are not flashy. They do not require new cryptography or complex protocols. But they work because they change the economics of the attack. The attacker needs the malicious package to be adopted quickly, and the time-based defenses make quick adoption harder. That is a tradeoff worth making.