Dependabot version updates introduce default package cooldown - GitHub Changelog
Dependabot version updates introduce default package cooldown Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration. New releases are a common entry point for supply chain attacks where a compromised or broken version can reach your dependency u
「OSS開発者は今何をするべきか？ソフトウェアサプライチェーン侵害対策を考える」で「Hardening npm Publishing」という発表をしました
2026年6月23日に、GMO Flatt Security主催の「OSS開発者は今何をするべきか？ソフトウェアサプライチェーン侵害対策を考える」で「Hardening npm Publishing」というタイトルで、npmパッケージの公開フローをどう守るかについて話しました。 スライド: Hardening npm Publishing ローカルのトークン管理やnpm Trusted Publishingについては、以前の記事で書きました。 1Passwordを使って、ローカルにファイル(~/.configや.env)として置かれてる生のパスワードなどを削除した | Web Scratch パスワード管理/MFA管理の戦略 | Web Scratch npm Trusted PublishingでOIDCを使ってトークンレスでCIからnpmパッケージを公開する この記事ではそれらを前提に
Safer pull_request_target defaults for GitHub Actions checkout - GitHub Changelog
Safer pull_request_target defaults for GitHub Actions checkout The pull_request_target event is one of the most commonly misused triggers in GitHub Actions, leading to vulnerabilities in workflows. Workflows triggered by pull_request_target run with the base repository’s GITHUB_TOKEN, secrets, and default-branch cache access. Checking out the head of an unreviewed pull request from a fork inside o
Control who and what triggers GitHub Actions workflows - GitHub Changelog
Menu. Currently selected: One policy, every repository Workflow execution protections are now in public preview for GitHub Enterprise, organizations, and repositories. This new capability lets enterprise administrators define an allow list that controls who can trigger GitHub Actions workflows and which events are permitted to run them, giving you predictable, secure workflow execution. Previously
GitHub - cicd-sensor/cicd-sensor: Open-source eBPF runtime security sensor for GitHub Actions and GitLab CI/CD.
When a compromised dependency in a CI/CD job steals your cloud credentials and leaks them, would you catch it? Would you have the logs to investigate afterward? cicd-sensor is an open-source sensor that lets every team answer both. Detection: Detects supply-chain attacks at runtime using process ancestry (e.g. credential access from a process descended from npm install) and correlation across sign
不正アクセス事案にかかる調査結果について
2026年4月3日以降にお知らせしております「GitHubアカウントへの不正アクセス発生に関するお知らせとお詫び」に関連し、外部専門機関による調査結果を踏まえ、事案の詳細についてご報告いたします。 はじめにこのたびは、弊社のシステム環境にかかる不正アクセスの発生によりお客様の個人情報が漏えいするリスクを生じさせてしまいましたこと、深くお詫び申し上げます。 お客様からお預かりした個人情報を守ることは、私たちの最も基本的かつ重要な責務であるところ、今回、お客様に重大なご心配をおかけする事態となりましたことを、重く受け止めております。信頼回復に向け、今回の対処及び外部専門機関と連携した原因の徹底究明を完了し、加えてセキュリティ体制の抜本的な見直しと強化に着手しました。詳細について、以下にご報告いたします。引き続き本件を重要な経営課題として、安心してご利用いただけるサービスの実現に全力を尽くしてま
Investigation update: GitHub Enterprise Server signing key rotation
May 26, 2026: GitHub recently detected a cyber-attack and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. It’s important to note that this investigation is still ongoing, and we will continue to provide details as appropriate. Given the reality of threat actors and the advent of AI technologies, w
Notice about upcoming new format for GitHub App installation tokens - GitHub Changelog
Notice about upcoming new format for GitHub App installation tokens Starting April 27th 2026 and over the coming weeks, we will begin a staged rollout that updates the format of newly minted GitHub App installation tokens, making them more performant and improving the reliability of our API surface. If your application expects or relies on installation tokens being exactly 40 characters long, it m
hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far - StepSecurity
A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in at least 4 out of 7 targets. The attacker, an autonomous bot called hackerbot-claw, used 5 different exploitation techniques and successfully exfiltrated a GitHub token with write permissions from one of the most popular repositories on GitHub. We're entering an
Changes to GitHub Dependabot pull request comment commands - GitHub Changelog
Menu. Currently selected: Dependabot comment command deprecations As we announced in October of 2025, we deprecated several Dependabot-specific pull request comment commands today in favor of GitHub’s native pull request features and functionality. This change is intended to reduce confusion, improve reliability, and encourage use of the GitHub platform’s built-in tools for working with pull reque
New repository settings for configuring pull request access - GitHub Changelog
Menu. Currently selected: Disable pull requests entirely Maintainers now have more control over how repositories accept contributions. Two new settings let you manage pull requests to better match your project’s needs. Disable pull requests entirely You can now turn off pull requests entirely from your repository’s Settings, just like you can with wikis, issues, discussions, and projects. When dis
GitHub - mitchellh/vouch: A community trust management system based on explicit vouches to participate.
A community trust management system. FAQ · Cookbook · Contributing People must be vouched for before interacting with certain parts of a project (the exact parts are configurable to the project to enforce). People can also be explicitly denounced to block them from interacting with the project. The implementation is generic and can be used by any project on any code forge, but we provide GitHub in
Towards a secure by default GitHub Actions · community · Discussion #179107
Why are you starting this discussion? Product Feedback What GitHub Actions topic or product is this about? Workflow Configuration Discussion Details Today, GitHub announced upcoming changes to the pull_request_target event, and environment protection rules. This is one of the first steps in a broader roadmap to make GitHub Actions more secure by default and we want to use this discussion post for
ghtkn でローカル開発用に GitHub Access Token をセキュアに生成して PAT から卒業する
ローカル開発のために GitHub App からセキュアに User Access Token を生成する CLI である ghtkn を紹介します。 まとめ ghtkn は Device Flow を用いて GitHub App から User Access Token を生成する CLI セキュアなローカル開発を実現 No More Personal Access Token Personal Access Token と違い短命 (8時間) な access token GitHub App とユーザー両方が持ってる権限しか持たず、両方がアクセスできるリポジトリにしかアクセスできない Secret manager を用いて access token を管理 プレインテキストや shell の環境変数に access token を露出しないため、流出リスクが低い 複数の GitHub
GitHub ActionsのSHA Pinning Enforcementを有効にするまでの道のり
2025年8月15日にGitHubからGitHub Actions周りの新機能として "SHA pinning enforcement" 機能がリリースされました。今年の3月にGitHub Actionsでのサプライチェーン攻撃があったことは記憶に新しいと思います。この新機能はこの種のサプライチェーン攻撃のリスクを低下させるためのものだと考えています。 まだリリース後間もないので不安定な部分もありますが、セキュリティ向上を目的にFinatextではこの機能の有効化に取り組みました。Finatextでのソフトウェア開発にはある程度の規模があるため、単に機能を有効にするのではなくプラットフォームとしての仕組みを整備しました。その過程を紹介します。 機能の概要 SHA pinning enforcementに関するまとめ記事を参考にしましたが、検証した結果一部さらに詳細な挙動が分かりました。 こ
GitHub Actions policy now supports blocking and SHA pinning actions - GitHub Changelog
GitHub Actions policy now supports blocking and SHA pinning actions GitHub Actions is powered by a diverse ecosystem of first-party and community contributed actions. If one of these actions has a vulnerability or is compromised by a malicious actor, it can impact all of its dependents in the supply chain. Tools like Dependabot can identify and upgrade actions versions with known vulnerabilities t
Releases now expose digests for release assets - GitHub Changelog
GitHub now automatically computes and displays SHA256 checksums (digests) for all uploaded release assets. These digests are generated at upload time, immutable, and let you verify that downloaded assets haven’t been altered since publishing. This improves integrity and transparency for every release. You can view or retrieve asset checksums anywhere you access releases: The GitHub Releases UI, ne
GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2)
GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2) Executive Summary Update April 2: Recent investigations have revealed preliminary steps in the tj-actions and reviewdog compromise that were not known until now. We have pieced together the stages that led to the original compromise, provid
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Release GitHub CLI 2.96.0 · cli/cli
Abusing Misconfigured OIDC Authentication In Cloud Environments - Christophe Tafani-Dereeper
