Reading up on Renovate

A survey finds that while many package managers and update tools have adopted dependency cooldowns to prevent supply chain attacks, implementations vary wildly in naming, scope, and timestamp handling, and major ecosystems like Go, Maven, and Gradle still lack support.

Dependabot's version-based security alerts are noisy and less effective than static analysis tools that check reachability of vulnerable functions.