GitHub adds a three-day Dependabot cooldown, while PyPI restricts changes to older releases to reduce supply-chain attack ...