Dependabot now waits three days before non-security version update pull…

If you rely on Dependabot, routine version bumps now arrive three days later by default — a deliberate trade of update latency for a window in which a compromised release can be found before it reaches your code.

• postGitHub Copilot local sandboxing reaches general availability
• postClaude Haiku 5.5 reaches general availability in GitHub Copilot
• articleWhy agent-scale Git forces GitHub to rebuild its storage layer
• postHow do you know whether an AI code reviewer catches the issues that matter…

• articleAn Exploratory Study of Dependabot Cooldown Adoption in Open-Source GitHub ProjectsHidetake Tanaka, Rikuto Tsuchida, Kazumasa Shimari, Raula Gaikovina Kula, Kenichi Matsumoto
• articleJust a rumour of a bug is enough to find a security exploit these dayssimonwillison.net
• blogGitHub Copilot app for Beginners: Automate Dependabot pull request triageChristopher Harrison

Checking sign-in…

Loading comments…