Dependabot version updates introduce default package cooldown • Hacker News Board

Re: Dependabot version updates introduce default package cooldown

#151

Post by JoshTriplett » Thu, Jul 16, 2026, 10:36 PM UTC

yearolinuxdsktp wrote: post #130

JoshTriplett wrote: post #42

Earlier quoted context omitted.

> I’m convinced that updating so much more often is worse, not better. The issue of cooldowns aside (which is about delaying updates, not reducing their frequency): you're going to have the same set of problems when you update, whether you do it frequently or infrequently. The difference is that if you update frequently, you'll have a smaller set of updates (so it's easier to debug) and you'll have more opportunity t…

Delaying non-security updates has the benefit of not wasting a team’s time when something regresses and is fixed in a quick follow up patch. Having to report issues upstream is not free.

Sure, by all means wait a week. Don't wait six months.

Re: Dependabot version updates introduce default package cooldown

#152

Post by tharkun__ » Fri, Jul 17, 2026, 4:25 AM UTC

SideburnsOfDoom wrote: post #107

tharkun__ wrote: post #51

Earlier quoted context omitted.

And if every malware developer worth their salt now introduces code to "wait out" that period of time, we're back to square one. This assumes that they employ clandestine enough techniques that you have to actually install, wait and observe the behavior for longer than the cooldown period in order to detect this, because the code is "obfuscated" enough to evade static analysis of the code. It's anti-virus / anti-anti…

> And if every malware developer worth their salt now introduces code to "wait out" that period of time, we're back to square one. Of course this is an arms race, but the time setting inside the sandbox doesn't need to be the same as outside.

That's a fair enough thing to say but then also setting the default to 7 days is no longer a necessity, because security researchers can automate running a new version through an accelerated time sandbox, can't they?

And no they can't and is probably why this change is happening to dependabot: A common pattern is sampling time before and after a sleep/timer, then aborting/delaying if the sandbox looks like it accelerated time by having a 1s sleep timer expire after 0.1s. Malware would also try to use different time sources and try to correlate them.

And yeah, like you say as well, of course its an arms race in the same way that back in the day state of the art viruses and worms were and anti-virus software was.

And personally I still liked it more when malware/supply chain attack actors assumed everyone was upgrading within a day or two while I was doing it after 7. You don't have to outrun the lion, just the guy slower than you and who's between you and the lion ;)

Re: Dependabot version updates introduce default package cooldown

#153

Post by sonukapoor » Sat, Jul 18, 2026, 7:45 PM UTC

Waterluvian wrote: post #18

I really hate dependabot making generic security people at work so pushy about updates updates updates. They seem to just be dogmatic about whatever dependabot says, forcing churn even when the documented issues are clearly not relevant. I’m not sure how to handle it politically. I’m convinced that updating so much more often is worse, not better.

[dead]

Re: Dependabot version updates introduce default package cooldown

#154

Post by sonukapoor » Sat, Jul 18, 2026, 7:45 PM UTC

bstsb wrote: post #11

> The default applies only to version updates. Security updates still open immediately, so critical fixes are never delayed. does this require a real vulnerability report, or CVE? if the package is compromised would they just be able to push a false "critical update" that bypasses this wait?

[dead]