Security vulnerabilities and automated fixes for cwe 1104 issues
1 post found
A high-severity vulnerability in `.github/dependabot.yml` left this repository vulnerable to supply chain attacks through immediate adoption of newly published packages. The fix adds a mandatory 7-day cooldown period to all three package ecosystems, preventing automatic updates to potentially malicious or unstable dependencies before they can be vetted by the community.