Security vulnerabilities and automated fixes for yaml misconfiguration issues
1 post found
A missing cooldown period in `.github/dependabot.yml` meant that newly published npm and GitHub Actions packages could be automatically proposed for adoption within minutes of release — before the security community has time to vet them. This high-severity finding was fixed by adding a `cooldown` block with `default-days: 7` to every `package-ecosystem` entry, giving the ecosystem time to flag malicious or unstable releases before they reach the codebase. Because this is a Node.js library, the r