Security vulnerabilities and automated fixes for dependency updates issues
1 post found
A high-severity supply chain vulnerability was discovered in a Node.js library's `.github/dependabot.yml` configuration file. Without a cooldown period, Dependabot could immediately propose updates to newly published (and potentially malicious) package versions, exposing downstream consumers to supply chain attacks. The fix adds a 7-day `cooldown` block to both the `npm` and `github-actions` ecosystem entries.