Łukasz Kliś 7 days ago
This kind of attack is getting more and more common.
Early in my career I used to update dependencies blindly — not anymore. For a few years now I’ve been locking packages to specific versions, reading changelogs carefully, and setting a `cooldown` in Dependabot (link in thread).
add a skeleton here at some point