GitHub, PyPI add time-based defenses against supply chain attacks

2026-07-28

Dependabot now holds version update pull requests for 72 hours by default so a malicious package flagged minutes after publication has time to be pulled before it lands in a repo.