Dependencies are a huge supply chain security risk; the more of them you have, and the more often you update, the bigger the attack surface.
  • Eager Eagle@lemmy.worldEnglish
    1·
    1 month ago

    You should probably turn off Dependabot

    Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.