Tag: Poisoned Package Adoption

GitHub has revealed a new cooldown feature in Dependabot that permits the tool to postpone opening a pull request for at least three days following the publication of a release. However, the behavior is still controlled by the cooldown configuration option in the dependabot.yml, so you can select a different cooldown parameter that works for your project, according to the Microsoft-owned company. GitHub claims that only version updates—which are intended to keep software dependencies current—are subject to the three-day cooldown setting. Security updates will keep being delivered immediately, enabling Dependabot to send out an alert and initiate a pull request to update the project to the updated version. The goal of this upgrade is to address situations in which a threat actor s...