#dependabot

Dependabot will now wait until a new package release has been on its registry for at least three days before opening a version-update pull request. Security updates still open immediately, and teams can tune or opt out through cooldown configuration.

GitHub now lets users assign Dependabot alerts to AI coding agents including Copilot, Claude, and Codex. The agents can analyze the advisory, open a draft pull request, and attempt to fix test failures, but GitHub says humans still need to review the output before merging.