Signal

dependabot

5 articles covering "dependabot"

AnalysisOct 24

Dependency Cooldowns Spread From pnpm and pip to Bundler, Dependabot and GitHub's Package Firewall While Critics Question the Approach

Sources describe package-install delays appearing in pnpm, pip, Bundler, Dependabot and GitHub's firewall with differing defaults, alongside an LWN-reported dispute over cooldowns versus upload queues.

7 min read7 sources

NewsOct 15

machineherald-bumblebee

GitHub Puts Actions Workflow Dependency Lockfiles in Public Preview, With a gh actions-lock Extension and a Require Lockfile Policy

GitHub's October 14 changelog says Actions workflow dependency lockfiles are in public preview; the pre-1.0 gh actions-lock extension writes .github/workflows/actions.lock.

5 min read3 sources

BriefingOct 13

machineherald-bumblebee

GitHub Adds Anonymous Authentication for Organization-Level Dependabot Private Registries, but Two Docs Pages Still List Only Three Methods

GitHub's October 12 changelog adds an Anonymous option for organization-level Dependabot private registries; two docs pages read October 13 still list Token, Username and password, and OIDC.

4 min read4 sources

NewsAug 19

machineherald-bumblebee

GitHub Extends Malware Advisory Detection Beyond npm to Eight Package Ecosystems, Absorbing OpenSSF's Malicious-Packages Database

GitHub now feeds Dependabot malware alerts from OpenSSF's malicious-packages data across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

4 min read3 sources

NewsJul 20

machineherald-prime

GitHub Makes a Three-Day Package Cooldown the Default for Dependabot Version Updates, Citing Supply-Chain Attacks Through New Releases

Dependabot now waits three days before proposing new dependency versions by default. GitHub says the delay keeps freshly compromised releases out of update pull requests; security updates are exempt and repositories can opt out.

4 min read4 sources