We should all be using dependency cooldowns(blog.yossarian.net)
460 points by todsacerdoti | 259 comments
Blog post arguing that dependency cooldowns, via tools like Dependabot and Renovate, are a cheap, effective way to mitigate most open source supply chain attacks.