#dependency-management
Tagged “dependency-management”
2 articlesSecurity & supply chain
Dependabot can finally pull from private GitHub Packages without a PAT
GitHub gave Dependabot its own GITHUB_TOKEN access to private GitHub Packages and GHCR, retiring one of the most awkward credentials in any CI setup. For pipeline owners, that closes a quiet but persistent rotation tax.
Jun 24, 2026 · Priya NairSecurity & supply chainPinning every CI action to a commit SHA is becoming the new minimum
A new write-up from the Cilium maintainers lays out a concrete playbook for locking down CI/CD dependencies, full-SHA pinning for every action, digest-pinned containers, vendored Go modules, and Renovate with a release-age cooldown. The pattern matters even if you do not ship eBPF for a living.
Jun 16, 2026 · Tomás Vega