Search Beyond the News

Showing 1–2 of 2 dossiers

Web Development Cloud & Infrastructure Deployment & DevOps Developer ToolsActive dossier

Dependabot’s private GitHub Packages access is back — now as fallback authentication

The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.

Published 9 Sep 2026Updated 10 Sep 20264 min read

Web Development Cloud & Infrastructure Deployment & DevOps Developer ToolsActive dossier

GitHub Actions adds workflow lockfiles that pin transitive dependencies

GitHub Actions lockfiles are in public preview for Enterprise Cloud, pinning direct and transitive actions and integrating with Dependabot. They don't prove a dependency is safe.

Published 15 Oct 2026Updated 15 Oct 20265 min read

Search results for “Dependabot”

Dependabot’s private GitHub Packages access is back — now as fallback authentication

GitHub Actions adds workflow lockfiles that pin transitive dependencies