#dependabot
-
GitHub and PyPI Introduce “Time-Based Holds” Against Supply-Chain Attacks
Dependabot now waits three days by default before updating dependencies, while PyPI bars adding files to releases older than two weeks. Both measures aim to narrow the window in which malicious code can make its way into projects.
-
GitHub Adds a Default Delay Before Package Updates in Dependabot
GitHub has changed the behavior of Dependabot version updates, introducing a waiting period before a package update is proposed by default. The news drew a notable response on Hacker News.