GitHub gives Dependabot a 3-day default cooldown before opening version-update PRs

·1 views

GitHub updated Dependabot on July 14, 2026, so that version-update pull requests are only opened after a package has been available on its registry for at least three days. The change is enabled by default across all supported ecosystems on github.com and will also apply to GitHub Enterprise Server starting with GHES 3.23. The rationale is to give the security community time to detect malicious or compromised releases before they are automatically pulled into build pipelines. Security-related updates are exempt from the cooldown and will still trigger pull requests immediately upon discovery. Developers can customize the waiting period in their dependabot.yml file, including setting it to zero to restore the previous always-fresh behavior.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Seven essential checks to run before a major WordPress upgrade

WordPress major version upgrades carry significantly higher compatibility risks than minor releases, including API deprecations, raised PHP requirements, and core block changes. Developers and site administrators are advised to verify PHP version compatibility across plugins and themes before upgrading, as mismatches can silently break operational tooling like WP-CLI. Reviewing each plugin's 'Tested up to' field and checking for recent development activity helps identify abandonment risks before an upgrade causes disruption. Taking at least three generations of full database and file backups is recommended, since incomplete migrations can be difficult to recover from. Testing the full upgrade process on a staging environment that mirrors production is strongly advised before applying any major version change to a live site.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineer Relocates from Dubai to Bangkok, Lands Remote Role at South African Tech Firm

A software engineer relocated from Dubai to Bangkok, Thailand, seeking a lower cost of living and a fully remote engineering role. He joined Exonic, a South African technology consulting company, after clearing a practical interview process covering AWS, system design, and full-stack development. Working as a remote employee embedded in Exonic's distributed team, he built cloud-native solutions on AWS for clients across multiple continents. His projects included a voice-enabled sports scoring app, a healthcare application for IBD patients in Malaysia, and a digital complaints platform for a South African media regulation body. The engineer cited Bangkok's infrastructure, fast internet, and affordability as key reasons for choosing the city as his remote work base.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Auto-Submission Tool After Wasting 12 Hours on Product Directories

A developer and founder built a tool called AutoSubmit.to after spending nearly 12 hours manually submitting a product to dozens of online directories during a recent launch. The repetitive process — copying taglines, pasting descriptions, and uploading screenshots across platforms like Product Hunt, BetaList, and Peerlist — inspired the creation of a more efficient solution. AutoSubmit.to lets users save their launch information once in a profile, which a Chrome extension then uses to autofill submission forms across supported directories. The tool intelligently maps fields to account for differences in how each platform labels and structures its forms. It is aimed at indie hackers, solo founders, and product teams looking to reduce operational overhead during product launches.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Node.js API Gateway Memory Leak Fixed by Scoping Event Listeners Per Request

A Node.js API gateway handling TLS termination, authentication, and microservice fan-out developed a gradual memory leak over several weeks, causing Kubernetes to OOM-kill pods under peak traffic. Heap snapshots revealed accumulating closures, request metadata, and event listeners tied to an internal event bus where an early-exit authentication path skipped cleanup, leaving listeners holding live references. Engineers resolved the issue by creating short-lived, request-scoped EventEmitters, enforcing teardown through try/finally blocks, and adding leak-aware CI tests that asserted bounded object counts across thousands of simulated requests. Operational safeguards including backpressure on accept queues, a soft memory threshold, and crash-loop rollback halting were also introduced. Following these changes, memory usage stabilized, pod restarts ceased, and autoscaling returned to managing load rather than concealing the underlying bug.

0 comments Read more at DEV Community