dependabot

GitHub says Dependabot reachability analysis is in public preview on Enterprise Cloud for JavaScript and TypeScript, using CodeQL call graphs to give each open alert one of four verdicts.

Sources describe package-install delays appearing in pnpm, pip, Bundler, Dependabot and GitHub's firewall with differing defaults, alongside an LWN-reported dispute over cooldowns versus upload queues.

GitHub's October 14 changelog says Actions workflow dependency lockfiles are in public preview; the pre-1.0 gh actions-lock extension writes .github/workflows/actions.lock.

GitHub's October 12 changelog adds an Anonymous option for organization-level Dependabot private registries; two docs pages read October 13 still list Token, Username and password, and OIDC.

GitHub now feeds Dependabot malware alerts from OpenSSF's malicious-packages data across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

Dependabot now waits three days before proposing new dependency versions by default. GitHub says the delay keeps freshly compromised releases out of update pull requests; security updates are exempt and repositories can opt out.