GitHub gives Dependabot version updates a three-day cooldown to curb short-lived poisoned packages, while security fixes still ship immediately.