3 ms·
> Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request So you explo
by 0xbadcafebee 3mo ago
> Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request
So you exploit on Tuesday 12pm, dependabot opens a PR on Friday 12pm, people merge it, and your trojan's timer is set to go off over the weekend when nobody is patching.