GitHub Adds 3-Day Cooldown to Dependabot Before Opening Update Pull Requests

·1 views

GitHub announced on July 14, 2026 that Dependabot will now wait at least three days after a package release is published before automatically opening a version-update pull request. The cooldown is enabled by default and requires no manual configuration across repositories. The delay is intended to allow time for broken or compromised releases to be identified before adoption, though it may also postpone urgent compatibility or security fixes. Experts note the cooldown is a baseline measure and does not replace lockfiles, CI pipelines, provenance checks, or rollback strategies. Teams are advised to document exceptions with clear evidence and treat any overrides as reviewable policy rather than ad hoc configuration changes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Anthropic Eyes $965B IPO as AI Labs Push Self-Regulation and Infrastructure Overhaul

Anthropic is reportedly scheduling investor meetings for a potential October IPO, with Morgan Stanley and Goldman Sachs testing the waters for a $965 billion valuation following a confidential S-1 filing. The company also drew criticism from the European Parliament after sending a junior employee to deliver AI-generated video testimony in place of its public policy head. On the infrastructure front, Perplexity unveiled a custom Firecracker microVM called SPACE, cutting agent environment creation latency from 447ms to 89ms and reducing sandbox costs by 80%. Vercel's execution sandbox is scaling rapidly, now generating 3.5 million environments daily with 100% month-over-month growth in daily active users. Separately, a proposed self-regulatory framework for frontier AI labs, modeled on FINRA, is facing international skepticism over concerns it could be used to sideline formal European and UK regulations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How React's 2013 Virtual DOM Pitch Evolved Into Today's Official Documentation

When React launched in 2013, it entered a web landscape dominated by jQuery, Backbone, and AngularJS, where manual or full-sweep DOM updates were standard practice. React's core promise was a declarative UI model backed by a Virtual DOM that would minimize costly browser rendering operations. However, the simplified marketing message led to widespread developer confusion between React's in-memory calculations and actual browser screen updates. To address this, the React team overhauled their official documentation, breaking the rendering process into three explicit steps: Trigger, Render, and Commit. They even introduced the term 'painting' to clearly distinguish browser screen updates from React's internal reconciliation work.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer releases TypeScript Akinator client that bypasses Cloudflare blocking in 2026

A developer has published akinator-client, a new TypeScript library that enables interaction with the Akinator game API after all existing npm packages stopped working. Popular alternatives such as aki-api and node_akinator were broken because Cloudflare began blocking their HTTP requests using JA3 TLS fingerprinting, returning HTTP 403 errors. The new library solves this by using got-scraping, an HTTP client that mimics Chrome's TLS fingerprint, making it indistinguishable from a real browser to Cloudflare. akinator-client supports 16 languages, multiple game themes, proxy configuration, and automatic retries, and is compatible with both ESM and CJS projects. The package is available on npm and the source code is hosted on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sovereign: Android privacy system offers hardware-level data isolation and anti-forensics

Developer Vladislav Shter has released Sovereign, a solo-built Android privacy ecosystem designed to protect users from covert data collection. The system features a three-profile isolated architecture and an X-Ray module that detects hidden data harvesting activity. A built-in offline AI tool called Sovereign Whisper enables on-device data analysis without cloud dependency. The platform also includes anti-forensics modes named The Veil and Forensic Bait to counter device investigation attempts. The project, last updated in July 2026, is open-source and available on GitHub alongside a live demo and an associated Web3 banking component.

0 comments Read more at DEV Community