GitHub will now send a Dependabot alert for vulnerable GitHub Actions which could make it easier to stay up to date and fix security vulnerabilities in your actions workflows. GitHub Actions (opens in new tab) is the platform’s continuous integration and delivery (CI/CD) solution, which allows users to automate their software development pipeline.  The new alerts will be powered by the GitHub Advisory Database, which is a security vulnerability database inclusive of Common Vulnerabilities and Exposures (CVEs) and GitHub-originated security advisories taken from the world of open source software.
…
Read more