Should Dependabot apply a default release cooldown before opening version update PRs?

[carlincherry]

We're considering delaying version update PRs until a release has been live on its registry for a few days, giving the community time to catch buggy or compromised releases before they're merged. You can already configure cooldowns in your dependabot.yml today and would still be able to opt out by setting it to 0 or letting a longer 7 days.

Please note this specifically applies to version updates and not security updates.