Security vulnerabilities and automated fixes for software composition analysis issues
1 post found
A high-severity vulnerability was discovered in a repository's `.github/dependabot.yml` configuration file that lacked a cooldown period for dependency updates. Without this protection, Dependabot could immediately propose updates to newly published packages, potentially introducing malicious or unstable code into the project before the security community has time to identify threats.