Skip to main content
developersIO

# ソフトウェアサプライチェーン articles

What We Learned from the OVHcloud CLI Release Replacement Incident: Tamper Protection for GitHub Releases - Immutable Releases and gh release verify-asset
西村祐二
2026.10.26
Verifying Claude Code's CVE-2026-86063 locally: git checkout prioritizes a branch of the same name over a commit SHA
西村祐二
2026.10.17
First Steps in Isolating the Execution Environment to Use Claude Code to the Fullest Safely
かずえ@製造BT
2026.09.08
The default cooldown period for Dependabot version updates is now 3 days.
quiver
2026.07.25
"What Should OSS Developers Do Now? Thinking About Software Supply Chain Compromise Countermeasures" Participation Report #oss_supplychain
quiver
2026.07.09
Use GitHub App User Access Token with ghtkn to communicate with GitHub without storing secrets locally
quiver
2026.06.24
Securely Pinning Action Versions in GitHub Actions: From Hashes and Immutable Tags to Workflow-Level Dependency Locking
quiver
2026.05.18
Mitigating GitHub Actions compromise and supply chain risks: Using pinact to specify actions by hash value instead of version
quiver
2025.03.17