Skip to main content
developersIO

# ソフトウェアサプライチェーン articles

The default cooldown period for Dependabot version updates is now 3 days.
quiver
2026.07.25
"What Should OSS Developers Do Now? Thinking About Software Supply Chain Compromise Countermeasures" Participation Report #oss_supplychain
quiver
2026.07.09
Use GitHub App User Access Token with ghtkn to communicate with GitHub without storing secrets locally
quiver
2026.06.24
Securely Specifying GitHub Actions Action Versions — From Hash Values and Immutable Tags to Workflow-Level Dependency Locking
quiver
2026.05.18
Mitigating GitHub Actions compromise and supply chain risks: Using pinact to specify actions by hash value instead of version
quiver
2025.03.17