Security vulnerabilities and automated fixes for security automation issues
1 post found
A high-severity vulnerability was discovered in `.github/dependabot.yml` where the GitHub Actions package ecosystem lacked a cooldown period for newly published packages. This configuration gap could have allowed malicious or unstable packages to be automatically proposed for integration within minutes of publication, exposing the project and its downstream consumers to supply chain attacks. The fix adds a 7-day cooldown period to wait before accepting updates from newly published package versio