🧰 Dependabot

The items that name it 32

• Bye Bye Brotli? Google's Compression Library Is a Security Mess
  articleas tools2026-10-25It is written here as Dependabot: raised the warning about an insecure Python Brotli version in November 2025.
• Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
  advisoryas tools2026-10-23It is written here as Dependabot: dependency alerting; does not flag these versions yet.
• Software supply chain security best practices for 2026
  articleas tools2026-10-21It is written here as Dependabot: keeps GitHub Actions pins current (GitHub Actions only).

  GitHub Actions only

• What We Can Learn About GitHub Actions Security from the Trivy Breach | Endor Labs
  articleas tools2026-10-16It is written here as Dependabot (mentioned: PRs updating an action's SHA should be carefully reviewed).

  mentioned: PRs updating an action's SHA should be carefully reviewed

• Secret protection must scale with software
  articleas affected products2026-10-07

  GitHub security product referenced as one the author has shipped work on

• Dependabot vs Renovate
  articleas classification.technologies2026-09-14
• Evaluating and Scoring OSS Packages | Endor Labs | Blog | Endor Labs
  articleas tools2026-09-11

  Automated dependency update tool whose PRs/commits are used as a data source and are filtered out when counting genuine development activity

• How to Defend Against NPM Software Supply Chain Attacks | Blog | Endor Labs
  articleas tools2026-09-11

  Automated dependency management tool supporting cooldown periods to delay adoption of newly published versions

• Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs
  writeupas tools2026-09-11

  Automated dependency management tool that can use cooldown periods to reduce risk of updating to newly published malicious package versions

• A trust checklist for GitHub Actions
  writeupas tools2026-09-04

  Dependency automation tool to propose updates to pinned actions, configurable with a cooldown period so a compromised release has time to be discovered before reaching pipelines.

• NPM Isn't Prepared For North Korean PolinRider Attack
  writeupas tools2026-08-25

  dependency vulnerability scanner referenced as relying on GHSA feed

• DocsGPT Security Hardening Playbook
  writeupas tools2026-08-15

  Keeps the dependency tree current and covers vulnerable deps between releases

• [tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements
  articleas tools2026-08-13

  Opens version update PRs; GitHub added a three-day cooldown

• Why NPM Malware Keeps Reaching for Bun | Supply Chain Security | Blog | Endor Labs
  articleas tools2026-08-12It is written here as Dependabot (dependency update tool, can enforce minimum release age).

  dependency update tool, can enforce minimum release age

• SecureAI-Scan
  repoas tools2026-08-05

  Dependency update/vulnerability alerting used on the SecureAI-Scan project

• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  articleas classification.technologies2026-07-31
• OpenSourceMalware Blog
  articleas tools2026-07-18

  GitHub dependency update tool; cooldowns feature discussed.

• The OpenSourceMalware Show #13
  talkas tools2026-07-16

  GitHub's open source SCA/dependency scanning and auto-upgrade tool; now applies a default 3-day cooldown period on version updates (overridden for security upgrades)

• SreeragPramod/securepipe
  repoas tools2026-07-15

  Automated dependency monitoring configured via .github/dependabot.yml

• Socket: actions/checkout v7 Blocks Unsafe pull_request_target Checkouts
  articleas tools2026-06-22

  used to upgrade workflows pinned to specific SHA, minor, or patch versions to receive the new protection

• Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection
  writeupas tools2026-06-02

  Dependency update tool; the developer who discovered the issue noticed odd CI log lines after a Dependabot update

• CVE Lite CLI
  repoas tools2026-05-31

  Opens PRs for vulnerable dependencies; contrasted as a slower, pipeline-oriented approach versus CVE Lite CLI's pre-push workflow.

• Open Source Malware Podcast — episodes
  otheras tools2026-05-22

  GitHub dependency update tool; three-day cooldown period now applied automatically to all version updates by default

• GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE
  writeupas tools2026-05-20

  Dependency vulnerability/update tooling referenced among leaked internal repos and enterprise features (enterprise_dependabot_*)

• Socket: fsnotify Maintainer Dispute
  articleas tools2026-05-13

  Automated dependency update tool, noted for making it easy to 'just update a dependency' without much thought

• Dependabot & Code Scanning: Org-Level Private Registries
  otheras tools2026-05-13

  Dependency scanning/updates, now supporting multiple org-level private registries per ecosystem

• GitHub Dependency Scanning MCP Server
  toolas affected products2026-05-11
• The complete GitHub Actions security checklist
  articleas tools2026-05-11

  Used to keep pinned SHAs up to date for third-party actions; can be given a dedicated bot account with explicit reviewer permissions for auto-merge instead of enabling workflow PR approval org-wide.

• CNCF Security Best Practices
  articleas tools2026-05-06

  Automatically raises pull requests to update vulnerable dependency versions to secure versions

• n8n Cybersecurity Workflows
  repoas tools2026-05-06

  Automated dependency vulnerability alerts/PRs

• Cooldowns.dev
  articleas tools2026-05-06

  GitHub's automated dependency update bot; default 3-day cooldown on version updates since July 2026, configurable via dependabot.yml, exempts security updates.

• OWASP Free AppSec Tools
  articleas tools2026-05-06

  GitHub service that creates pull requests to keep dependencies up-to-date across many languages