#dependabot
Tagged “dependabot”
5 articlesGitHub's Dependabot playbook: group the version PRs, slow the cadence, keep security fast
A GitHub blog post dated 2026-07-29 lays out the three-lever config for making Dependabot survivable on a busy repo: group version updates into one PR, slow the schedule to weekly or monthly, and let security updates keep flowing on their own timing. It is a few lines of YAML that turn a bot most teams half-mute back into something they can triage.
Aug 14, 2026 · Priya NairSecurity & supply chainPyPI stops accepting late file uploads to releases older than 14 days
PyPI will no longer accept new files uploaded to a release once that release is more than 14 days old, closing a stealth path a compromised publishing token could otherwise use to graft malicious code onto an established package. PyPI has said it is not yet aware of the technique being used in a real attack.
Jul 28, 2026 · Maya OkonkwoSupply chain securityDependabot learns to wait: version-update PRs now sit for three days by default
GitHub is flipping Dependabot version updates to a default three-day package cooldown. A new release has to sit on its registry for at least three days before Dependabot will open a version-update PR; security updates are exempt and still open immediately.
Jul 15, 2026 · Tomás VegaSupply-chain securityInnersource security advisories go GA: a private channel for private vulns
GitHub Advanced Security now lets enterprise customers publish security advisories that stay inside the enterprise, and Dependabot picks them up like it would a public CVE. Useful, narrow, and only as good as the discipline behind it.
Jul 11, 2026 · Tomás VegaSecurity & supply chainDependabot can finally pull from private GitHub Packages without a PAT
GitHub gave Dependabot its own GITHUB_TOKEN access to private GitHub Packages and GHCR, retiring one of the most awkward credentials in any CI setup. For pipeline owners, that closes a quiet but persistent rotation tax.
Jun 24, 2026 · Priya Nair