4 ms·

> Sadly, not enough tooling seems to take this into account Most tooling (e.g. Dependabot) allows you to set an interval between version checks. What more coul

• mirashii 11mo ago
  The check frequency isn't the problem, it's the latency between release and update. If a package was released 5 minutes before dependabot runs and you still update to it, your lower frequency hasn't really done anything.
  • hypeatei 11mo ago
    What are the chances of that, though? The same could happen if you wait X amount of days for the version to "mature" as well. A security issue could be found five minutes after you update. EDIT: Github supports this scenario too (as mentioned in the article): https://github.blog/changelog/2025-07-01-dependabot-supports-configuration-of-a-minimum-package-age/ https://github.blog/changelog/2025-07-01-dependabot-supports... https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown- https://docs.github.com/en/code-security/dependabot/working-...
    • mirashii 11mo ago
      > What are the chances of that, though? The whole premise of the article is that they’re substantially lower, because some time for the ecosystem of dependency scanners and users to detect and report is better than none.
  • deleted 11mo ago
    [deleted]