Dependabot

Three open wooden doorways flooded with gold light beside a fourth doorway half bricked up

Give your agent's npm installs a release-age floor, so it never installs what was published this morning

Three settings, one for npm, one for pnpm and one for Dependabot, keep a coding agent off versions that are hours old. Real output from each, and what the floor can't stop.

21 October 20268 min read

A chunky matte clay padlock clamped around a short chain whose middle links glow teal, on a dark surface.

GitHub News

GitHub Actions now has a lockfile. It's the cheapest way to stop an agent's workflow edits pulling in a moved tag

Workflow lockfiles pin every action to a commit while your YAML keeps readable tags. What it does, what it doesn't, and the one line to add to your agent's instructions.

14 October 20266 min read