2026年7月27日 4:01 ET 发布 · 更新于 4 个月前 · 1 个来源
GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
The Hacker News
·
原始报道
GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project," the Microsoft-owned subsidiary said. According to GitHub, the
原文