For years, software had one unspoken rule: update right away, the newest is the safest. GitHub just said out loud that this is no longer true.
Fact
The facts: On 23 July 2026 GitHub announced that Dependabot - the bot that suggests package updates across millions of projects - now waits three days by default before opening a pull request for a new version. The rule applies only to routine version updates; patches for known vulnerabilities keep arriving immediately. Context: over the year through May 2026, GitHub's own data logged an average of around 18 malicious npm packages a day, and an analysis of 21 major supply-chain incidents shows that compromised versions typically get pulled within hours of appearing. The window is configurable in dependabot.yml. Source: GitHub, 23.07.2026.
The mechanics are simple, and that's exactly why they work. A poisoned version lives for hours - wait three days and it's already pulled before it ever reaches you. Not because you were smarter, but because you weren't first.
Newest stopped being a synonym for safest.
The lesson holds outside code too. The first hours of anything new - a version, a tool, a service - are the hours where the surprises hide. And nobody hands out a medal for installing first. Three days of patience is the cheapest defense I've seen this year.
Official primary sources
GitHub - The case for a cooldown (Dependabot), 23.07.2026The visual is generated code-art, no third-party images.