To mitigate supply-chain risks, add a "cooldown" period to the dependabot-auto-merge action, so that it won't merge automatically if the fixed version is less than some number of days old. If the action is unable to merge, the action is rescheduled through some mechanism TBD, and the alert is evaluated through mechanisms TBD. If the evaluation determines that it may be less risky to take the incoming new dependency than to defer merging (e.g. if a "break glass in case of emergency" is warranted), an alert is sent through some mechanism TBD.
To mitigate supply-chain risks, add a "cooldown" period to the dependabot-auto-merge action, so that it won't merge automatically if the fixed version is less than some number of days old. If the action is unable to merge, the action is rescheduled through some mechanism TBD, and the alert is evaluated through mechanisms TBD. If the evaluation determines that it may be less risky to take the incoming new dependency than to defer merging (e.g. if a "break glass in case of emergency" is warranted), an alert is sent through some mechanism TBD.