Tag

#escrow

2 posts ·all posts

Relatedsupply-chainrustnpmpythongosecurityrenovatecargo
· Jacob Verhoeks

Renovate + Supply Chain: What It Actually Intercepts (and What It Doesn't)

We tested Renovate's registry behaviour for every ecosystem — npm, PyPI, Go, Cargo, Maven, NuGet, Composer — and found that minimumReleaseAge works for all of them, but how each datasource resolves its registry is surprisingly different. Here's what we found and how to build a complete defence.

Read
· Jacob Verhoeks

Supply Chain Attacks Hit Every Ecosystem. Here's How to Defend Yours.

A three-layer defense for developers and DevOps engineers: harden your dev machine in 5 minutes, lock down project configs for every ecosystem, and enforce policy org-wide with a proxy. Covers npm, pnpm, yarn, bun, pip, uv, Go, Maven, Gradle, NuGet, Cargo, and Composer — plus escrow, JFrog Curation, and Nexus.

Read