4 ms·
Every dependency you add is a supply chain attack waiting to happen
- Serhii-Set 7mo ago[dead]
- politelemon 7mo agoI would recommend adding a delay to your dependabot updates and grouping the updates together into one pull request. Despite the noise produced it's a useful tool in that it calls for your attention. It's all in the configuration: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#configuration-of-cooldown https://docs.github.com/en/code-security/reference/supply-ch...