An Exploratory Study of Dependabot Cooldown Adoption in Open-Source GitHub Projects

• URL: http://arxiv.org/abs/2609.16605v1
• Date: Tue, 15 Sep 2026 04:02:08 GMT
• Title: An Exploratory Study of Dependabot Cooldown Adoption in Open-Source GitHub Projects
• Abstract summary: GitHub made Dependabot generally available as a defense against software supply chain attacks.<n>Security concerns motivated 83 of 92 adoption events with known motivations.<n>Early adopters favor simple default delays over fine-grained controls.
• Score: 2.385829414517223
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Automated dependency updates can rapidly propagate malicious package releases before maintainers and the broader community have enough time to detect them. In July 2025, GitHub made Dependabot cooldown generally available as a defense against software supply chain attacks. However, the effects of its early adoption remain unknown. In this exploratory study, we empirically examine how popular open-source GitHub repositories adopt and configure the feature and investigate their motivations. We find that security concerns motivated 83 of 92 adoption events with known motivations. Security linter warnings triggered 43 of 75 security-only adoptions. Among 251 ecosystems within repositories that retained cooldown, 97.2% set a general delay. Of these, 64.3% used seven days, while use of each update type setting was below 10%. Early adopters therefore favor simple default delays over fine-grained controls. These findings suggest that tools could provide robust defaults reflecting ecosystem support and reserve fine-grained controls for dependencies with clear update priorities.

Related papers

• Analysis of Commit Signing on Github [2.1045887299238855]
  We studied 71,694 active GitHub users, defined as accounts that have authored at least one commit, across all their repositories and their entire commit history, spanning 16 million commits and 874,198 repositories.<n>Fewer than 6% of developers have ever signed a commit themselves, and the vast majority of apparent signers have never signed outside a web browser.<n>Among the minority who do sign locally, signing rarely persists over time or across repositories, and roughly one in eight developer-managed signatures fails verification because signing keys are never uploaded to GitHub.
  arXiv  Detail & Related papers  (2026-04-15T15:57:07Z)
• Mining the YARA Ecosystem: From Ad-Hoc Sharing to Data-Driven Threat Intelligence [0.30586855806896046]
  YARA has established itself as the de facto standard for "Detection as Code"<n>Despite its pervasive use, the open-source YARA ecosystem remains characterized by ad-hoc sharing and opaque quality.<n>We conducted a large-scale mixed-method study of 8.4 million rules mined from 1,853 GitHub repositories.
  arXiv  Detail & Related papers  (2026-03-15T03:01:13Z)
• Trace: Securing Smart Contract Repository Against Access Control Vulnerability [58.02691083789239]
  GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files.<n>Third-party developers often reference, reuse, or fork code from these repositories during custom development.<n>Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories.
  arXiv  Detail & Related papers  (2025-10-22T05:18:28Z)
• What Do They Fix? LLM-Aided Categorization of Security Patches for Critical Memory Bugs [46.325755802511026]
  We developLM, a dual-method pipeline that integrates two approaches based on a Large Language Model (LLM) and a fine-tuned small language model.<n>LM successfully identified 111 of 5,140 recent Linux kernel patches addressing OOB or UAF vulnerabilities, with 90 true positives confirmed by manual verification.
  arXiv  Detail & Related papers  (2025-09-26T18:06:36Z)
• Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware [52.84746696418136]
  We present a systematic, global, and longitudinal measurement study of fake stars in GitHub.<n>We build StarScout, a scalable tool able to detect anomalous starring behaviors across all GitHub metadata between 2019 and 2024.<n>Analyzing the data collected using StarScout, we find that: (1) fake-star-related activities have rapidly surged in 2024; (2) the accounts and repositories in fake star campaigns have highly trivial activity patterns; and the majority of fake stars are used to promote short-lived phishing malware repositories.
  arXiv  Detail & Related papers  (2024-12-18T03:03:58Z)
• Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures [47.435076500269545]
  Apache Log4J was found to be vulnerable to remote code execution attacks. More than 35,000 packages were forced to update their Log4J libraries with the latest version. It is practically reasonable for software developers to update their third-party libraries whenever the software vendors have released a vulnerable-free version.
  arXiv  Detail & Related papers  (2024-11-12T01:55:51Z)
• Analyzing the Accessibility of GitHub Repositories for PyPI and NPM Libraries [91.97201077607862]
  Industrial applications heavily rely on open-source software (OSS) libraries, which provide various benefits.<n>To monitor the activities of such communities, a comprehensive list of repositories for the libraries of an ecosystem must be accessible.<n>In this study, we analyze the accessibility of GitHub repositories for PyPI and NPM libraries.
  arXiv  Detail & Related papers  (2024-04-26T13:27:04Z)
• Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem [0.773844059806915]
  A comprehensive investigation was undertaken to examine the life cycle of vulnerability in Golang. It turned out that 66.10% of modules in the Golang ecosystem were affected by vulnerabilities. By analyzing reasons behind non-lagged and lagged vulnerabilities, timely releasing and indexing patch versions could significantly enhance ecosystem security.
  arXiv  Detail & Related papers  (2023-12-31T14:53:51Z)
• On the Security Blind Spots of Software Composition Analysis [46.1389163921338]
  We present a novel approach to detect vulnerable clones in the Maven repository. We retrieve over 53k potential vulnerable clones from Maven Central. We detect 727 confirmed vulnerable clones and synthesize a testable proof-of-vulnerability project for each of those.
  arXiv  Detail & Related papers  (2023-06-08T20:14:46Z)
• An Empirical Study on Workflows and Security Policies in Popular GitHub Repositories [9.048328480295224]
  In open-source projects, anyone can contribute, so it is important to have an active continuous integration and continuous delivery (CI/CD) pipeline. Many of these projects are hosted on GitHub, where maintainers can create automated security policies. We measure the usage of GitHub and security policies in thousands of popular repositories based on the number of stars.
  arXiv  Detail & Related papers  (2023-05-25T14:52:23Z)
• Detecting Security Patches via Behavioral Data in Code Repositories [11.052678122289871]
  We show a system to automatically identify security patches using only the developer behavior in the Git repository. We showed we can reveal concealed security patches with an accuracy of 88.3% and F1 Score of 89.8%.
  arXiv  Detail & Related papers  (2023-02-04T06:43:07Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.