GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. The introduction of a cooldown period for automated dependency updates like GitHub's Dependabot addresses a critical security concern in the software supply chain.
https://meta-news.info/ver/github-adds-3-day-dependabot-cooldown-to-limit-poisoned-package-ad…
GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. The introduction of a cooldown period for automated dependency updates like GitHub's Dependabot addresses a critical security concern in the software supply chain.
https://meta-news.info/ver/github-adds-3-day-dependabot-cooldown-to-limit-poisoned-package-ad…