Tag: GitHub Dependabot
GitHub Quietly Fixes One of Dependabot’s Oldest Headaches
GitHub Dependabot can now authenticate to GitHub-hosted package registries without personal access tokens, reducing credential management and supply chain security risk ...
GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks
Tom Smith | | automated updates, CI/CD security, dependency cooldown, dependency pinning, dependency updates, devops security, GitHub Dependabot, lockfiles, malicious packages, open source security, package poisoning, package registry security, platform engineering, PyPi, Python Package Index, scoped access tokens, Software Supply Chain Security, supply chain attacksGitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads ...
