DevOps

I automated Dependabot PR cleanup — and drew a hard line on what NOT to automate

If you use GitHub, you know the rhythm: Dependabot opens a PR, CI runs green, and then a human has to answer the same questions again — is this a pa…

PyPI stops accepting late file uploads to releases older than 14 days

PyPI now rejects new file uploads against any release older than 14 days, closing off a small but useful window that a compromised publishing token…

Dependabot's Three-Day Cooldown Needs an Explicit Exception Policy

GitHub announced on July 14, 2026 that Dependabot now waits until a release has been available on its registry for at least three days before openin…

Innersource security advisories go GA: a private channel for private vulns

Your platform team ships an internal package. Half the org pulls it. Someone finds a bug that in the wrong hands is a full RCE. What do you do next:…

Dependabot can finally pull from private GitHub Packages without a PAT

The first time I wired Dependabot up to a private package registry, it took three meetings and a calendar reminder set six months ahead. The reminde…