Provenance Record

Clean, well-structured News piece (777 words, within the 400-1200 News range). Standard Overview / What We Know / What We Don't Know / Analysis format. Technical depth is appropriate and accurate; the distinction between version updates (delayed) and security updates (immediate) is handled precisely.

Read all 4 committed snapshots from disk (source-0..3, all status 200, no archive fallbacks). source-0 (github.blog 2026-07-14): confirmed verbatim every quote and specific — 'Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request', 'is now the default and requires no configuration', the supply-chain framing sentence, 'A short delay gives that signal time to surface...', 'The default applies only to version updates. Security updates still open immediately, so critical fixes are never delayed', the '.github/dependabot.yml' cooldown option to 'set a different window or opt out entirely', and 'across all supported ecosystems on github.com and will take effect in GitHub Enterprise Server (GHES) 3.23'. source-1 (github.blog 2025-07-01): confirmed GA date July 1 2025, 'configure a minimum age requirement before Dependabot creates a pull request for a newly released dependency', 'different cooldowns per semver type', and 'for all supported package ecosystems today except for NuGet'. source-2 (github.blog 2025-07-29): confirmed 'expanded Dependabot's cooldown feature to now support Nuget and Helm'. source-3 (lwn.net/Articles/1068692, by Joe Brockmeier, April 22 2026 — supports the article's 'reported in April'): confirmed the November 2025 William Woodruff blog post, the 'invest in first-class support for cooldowns directly in their package managers' quote (attributed to Woodruff, correct), the 'including Go, JavaScript, Python, and Rust' ecosystem list, Cal Paterson's April 13 argument against cooldowns, the 'publishing and distribution are different things' paraphrase, and the Debian upload-queue alternative. The Paterson quote 'Frankly, dependency cooldowns work by free-riding on the pain and suffering of others' is genuinely Paterson's own wording (from his blog calpaterson.com/deps.html) and appears verbatim on the cited LWN page; the article correctly attributes it to Paterson. Note: LWN's reporter body renders the fragment 'by free-riding on the pain and suffering of others', while the full sentence appears on the same page quoting Paterson's original post — attribution and wording are both accurate.

All specifics trace to cited sources: three-day default window, July 14 announcement, GHES 3.23, July 1 2025 opt-in GA, NuGet exclusion then Nuget+Helm expansion, November 2025 Woodruff post, April LWN report. Headline, summary, and Overview lead are each fully supported by source-0. No hallucinated quotes or fabricated specifics detected.

High-quality, fully-sourced News submission. All 4 sources personally read from snapshots and verified; every direct quote is verbatim and correctly attributed; every specific traces to a cited source; no orphan URLs (all 4 body external URLs are in article.sources). Signature and payload hash valid. APPROVE with no corrections needed.