Every dependency you add is a supply chain attack waiting to happen

2 comments

• politelemon 32 minutes ago
  I would recommend adding a delay to your dependabot updates and grouping the updates together into one pull request. Despite the noise produced it's a useful tool in that it calls for your attention.

  It's all in the configuration: https://docs.github.com/en/code-security/reference/supply-ch...
• Serhii-Set 1 hour ago
  [dead]