Topic

#supply-chain-security

Loot, blog posts and adjacent themes connected to this topic. Follow the tag to keep it in your orbit.

#supply-chain-security
#github#developer-tools#dependabot#CI#CI/CD#GitHub Actions#npm#2fa
Loot

More from this topic

Explore all loot
Use Dependabot's default cooldown before merging fresh package releases 1

Use Dependabot's default cooldown before merging fresh package releases

0
#github#dependabot+3
GitHub now waits three days before opening Dependabot version-update pull requests, reducing exposure to compromised or broken package releases. GitHub has changed Dependabot version updates so new package releases must sit in the registry for at least three days before Dependabot opens a version-update pull request. Security updates still open immediately. Use this as a low-friction supply-chain safety check. The default gives maintainers and the wider ecosystem time to flag compromised, yanked, or broken releases before they land in routine dependency-update PRs. What to do Leave the new default in place for most repositories. Keep security updates immediate; the cooldown applies to version updates, not urgent security fixes. Override the window in .github/dependabot.yml only when your release process has a clear reason. Watch high-risk ecosystems or critical services for packages that should use a longer cooldown. Best fit Repository type Suggested move Caveat --- --- --- Standard app repos Keep the three-day default Review lockfile-only bumps before merge Security-sensitive services Consider a longer cooldown for non-security updates Do not delay patched security advisories Fast-moving libraries Tune per ecosystem in dependabot.yml Document why the shorter window is acceptable
Free
Review open
0
Open loot
Verify JDK Downloads in GitHub Actions with setup-java 5.5 1

Verify JDK Downloads in GitHub Actions with setup-java 5.5

0
#GitHub Actions#Java+3
GitHub Actions setup-java 5.5 adds optional cryptographic signature verification for downloaded JDKs, plus Tencent Kona support and Maven workflow fixes. Use this when Java CI needs stronger supply-chain checks without replacing the standard setup-java action. Enable verify-signature: true for supported distributions such as Temurin and Microsoft, pin the action to v5.5.0 or its full commit SHA, and fail fast when a distribution cannot verify signatures instead of silently accepting an unchecked JDK download. This is a TOOL candidate, not a broad news post: it helps teams harden Java workflows, but it does not materially change the whole developer platform.
Free
Review open
0
Open loot
Blog

Related reads

Browse blog
Tools & Apps

npm 2FA-bypass tokens lose account powers as GitHub tightens registry security

GitHub has restricted npm granular access tokens that bypass 2FA from sensitive account, organization, and package-management actions, with …

Tools & Apps

Delay Dependabot Version PRs Before Fresh Packages Hit Your Build

GitHub now delays Dependabot version update pull requests for three days by default, giving maintainers and scanners time to catch compromis…

Tools & Apps

GitHub actions/checkout v7: Security and Breaking Changes

GitHub actions/checkout v7 blocks common pwn-request patterns. See the July 16 backport, affected workflows, breaking behavior and upgrade c…

Tools & Apps

Use GitHub Innersource Advisories before internal packages hide security fixes

GitHub Advanced Security enterprise customers can now publish private internal advisories that trigger Dependabot alerts and fixes across re…

Tools & Apps

npm v12 turns risky install behavior into explicit opt-in

npm v12 is now tagged latest, turning dependency install scripts, Git dependencies, and remote URL packages into explicit opt-in paths while…