Security vulnerabilities and automated fixes for yaml configuration issues
3 posts found
A semgrep scan flagged `.github/dependabot.yml` for lacking a cooldown period, meaning Dependabot would immediately propose updates to brand-new package versions across npm, Bundler, and Docker ecosystems. The fix adds a `cooldown: default-days: 7` block to every `package-ecosystem` entry, forcing a one-week waiting period before newly published releases are considered — reducing exposure to malicious or unstable package drops.
A pnpm workspace configuration was missing the `minimumReleaseAge` setting, creating a supply chain vulnerability where newly published (and potentially malicious) packages could be installed immediately. By adding a 10,080-minute (7-day) minimum release age to `pnpm-workspace.yaml`, the project now enforces a critical delay that allows the security community time to identify and report malicious or unstable packages before they reach production environments.
A missing cooldown configuration in Dependabot allowed the automatic proposal of newly published (and potentially malicious) package versions, creating a supply chain attack vector that could have facilitated the exploitation of CVE-2026-47343 — a broken access control vulnerability in TYPO3's File Abstraction Layer. The fix adds a 7-day cooldown period to all package ecosystem entries in `.github/dependabot.yml`, ensuring newly published packages are vetted by the community before being propose