DevBleepingComputerabout 2 hours ago
GitHub and PyPI add time-based supply chain defenses
1 min read
GitHub's Dependabot now defaults to a 72-hour cooldown before updating packages. PyPI blocks new file uploads to releases older than 14 days. Both measures aim to reduce the window for malicious package adoption after publication.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyGitHub
