#dependabot

[eshraagcom]

حالة التباطؤ: لماذا ينتظر Dependabot الآن قبل إصدار تحديثات الإصدار

في سبتمبر 2025، قام أحد المهاجمين بتصيد بيانات اعتماد مشرف npm واحد ونشر إصدارات مفخخة من chalk, debugوحوالي اثنتي عشرة حزمة أخرى يتم تنزيلها معًا أكثر من 2 مليار مرة في الأسبوع. أعاد الرمز كتابة عناوين محفظة العملة المشفرة داخل أي تطبيق متصفح قام بتحميله. ظلت النسخ المسمومة حية لمدة ساعتين تقريبًا قبل أن يمسكها المجتمع ويسحبها npm. ساعتين هي استجابة سريعة. ومع ذلك، فهو أيضًا وقت أكثر من كافٍ…

View On WordPress

[muellermh]

Third-Party Actions pinnen: warum SHA statt Tag und was eine Allowlist bringt

Fast jeder GitHub-Actions-Workflow zieht fremden Code. actions/checkout@v4, docker/build-push-action@v6, dazu ein Dutzend kleinerer Helfer aus dem Marketplace. Bequem, aber jede dieser Zeilen ist eine Vertrauensentscheidung. Wer @v4 schreibt, sagt damit: ich fuehre aus, was hinter diesem Tag heute steht, und auch das, was morgen dahinter steht. Genau das ist das Problem. Ein Tag ist kein…

[muellermh]

Dependabot und Renovate: automatische Updates richtig einsetzen

Veraltete Abhängigkeiten sind der häufigste Weg, über den Schwachstellen in Software gelangen. Nicht der eigene Code, sondern die 300 Pakete darunter. Automatische Update-Tools wie Dependabot und Renovate lösen genau dieses Problem. Trotzdem scheitert die Einführung in vielen Teams. Nicht am Tool, sondern an der fehlenden Strategie dahinter. Was beide Tools tun Dependabot und Renovate…

[blue-headline]

GitHub’s Supply Chain Warning Is Really About Secret Theft, Not Just Bad Packages

When developers hear “open source supply chain attack,” they usually picture a poisoned package. GitHub’s latest security post makes a sharper point: many modern supply-chain attacks are starting earlier, with secret exfiltration from CI/CD workflows. The bad package still matters, but it may be the downstream consequence rather than the first move. That distinction matters because it changes…

GitHub’s Supply Chain Warning Is Really About Secret Theft, Not Just Bad Packages

[digitalcreationsllc]

Cannot Depend on Dependabot: Found Contributing Malicious Code

In July, a security anomaly surfaced when atypical commits, disguised as Dependabot contributions, were detected in numerous GitHub repositories. On closer examination, these commits were found to harbor malicious code, raising serious concerns within the developer community. Diving into Details Threat actors meticulously fabricated commit messages to mimic Dependabot’s automated contributions…

View On WordPress

[andytriboletti]

Testing my #DNA with #23andme. Merging Pull Requests from #github #dependabot Post #941 🍎 https://www.instagram.com/p/Cjd_YLvAL8y/?igshid=NGJjMDIxMWI=

[cybeout]

Github acquisisce Dependabot e ora lo offre gratuitamente

#Github acquisisce #Dependabot e ora lo offre gratuitamente

Microsoft continua ad arricchire le funzionalità offerte da GitHub . La piattaforma ha appena annunciato l’acquisizione di Dependabot , uno strumento open source che automatizza gli aggiornamenti dei file di dipendenza. In particolare, è in grado di rilevare componenti non protetti di un progetto in corso e sostituirli con versioni corrette.

Sempre più opzioni per facilitare e moltiplicare gli…

View On WordPress

[poittry]

Key Note Session

27 million vulnerability alerts white source dependency get this let's go ahead hard problem security issue a very dark place how to work with you go to a nice place with the people you trust new issue comes in in a completely private space people you invite will take care of the rest everyone dealing with it you are dependabot