vlt 1.0 & Hosted Package RegistriesStable client release and general availability of hosted JavaScript registries & ecosystem mirrors. Today, we're happy to announce vlt 1.0, and general availability of our hosted JavaScript package registries and ecosystem mirrors. With these releases, vlt is now an end-to-end platform for developers, their teams and agents to ship faster, safer, and more reliabl

How Chrome is using AI to improve vulnerability discovery, triage, and patching. We’re living through a massive shift in the software security industry. Large Language Models (LLMs) are unlocking unprecedented capabilities for automated vulnerability discovery, scaling far beyond the limits of human security expertise, and requiring new approaches for staying ahead of attackers. This means deployi

著者 山口崇徳　著 定価 3,520円（本体3,200円＋税10%） 発売日 2026.8.20 判型 B5変形 頁数 328ページ ISBN 978-4-297-15805-7 978-4-297-15806-4 概要 DNSを基礎からしっかり理解し、実際の運用現場で迷わず実践できるようになることを目的として本書は執筆されました。本書では、読者のレベルと目的に合わせて段階的に学べる「3部構成」を採用しています。 第1部：入門編 〜ITに関わるすべての人へ〜 まずはドメイン名とDNSの概念、基本的な仕組みをわかりやすく解説。DNSを専門に扱うエンジニアでなくても、「インターネットの裏方」として知っておくべき必須知識がここに詰まっています。 第2部：上級編 〜プロトコルと運用の本質を知る〜 DNSのプロトコルへの理解をさらに深め、リソースレコードの登録・運用に必要な実践的知識を解説。どのよう

Menu. Currently selected: Packages are scanned before they become available As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement for dual-use content. Packages are scanned before they become available Newly published packages will be automatically scanned

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert

Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only issue, so make sure it updates too. If you can't upgrade to the patched releases for some reason (for example, you're pinned to an older release line), Socket has provided Certified Patches for Nuxt which can be applied across release lines as an interim measure. Upgrading remains the reco

Back to BlogMonday, July 13th 2026 Next.js Security Release and Our Next Patch ReleasePosted by July 20, 2026: The July security release originally targeted for July 20 is now expected on July 21, 2026. We invest in security at every stage of the Next.js lifecycle, from static analysis and scanning as code is authored, through auditable package publication, to close collaboration with researchers

Dependabot version updates introduce default package cooldown Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration. New releases are a common entry point for supply chain attacks where a compromised or broken version can reach your dependency u

Use of the SSM Parameter Store's path-based API is now required. Support added in v2.0 to avoid it has been removed. The CHAMBER_NO_PATHS environment variable no longer has any effect. You must migrate to the new storage format using the instructions below, using a 2.x version of chamber. The --min-throttle-delay option no longer has any effect. Support for specifying a minimum throttle delay has

Menu. Currently selected: Install-time security defaults are now on npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation of the most sensitive uses of 2FA-bypass granular access tokens (GATs). Install-time security defaults are now on As of npm v12, the following npm ins

2026年6月23日に、GMO Flatt Security主催の「OSS開発者は今何をするべきか？ソフトウェアサプライチェーン侵害対策を考える」で「Hardening npm Publishing」というタイトルで、npmパッケージの公開フローをどう守るかについて話しました。 スライド: Hardening npm Publishing ローカルのトークン管理やnpm Trusted Publishingについては、以前の記事で書きました。 1Passwordを使って、ローカルにファイル(~/.configや.env)として置かれてる生のパスワードなどを削除した | Web Scratch パスワード管理/MFA管理の戦略 | Web Scratch npm Trusted PublishingでOIDCを使ってトークンレスでCIからnpmパッケージを公開する この記事ではそれらを前提に

Safer pull_request_target defaults for GitHub Actions checkout The pull_request_target event is one of the most commonly misused triggers in GitHub Actions, leading to vulnerabilities in workflows. Workflows triggered by pull_request_target run with the base repository’s GITHUB_TOKEN, secrets, and default-branch cache access. Checking out the head of an unreviewed pull request from a fork inside o

Menu. Currently selected: One policy, every repository Workflow execution protections are now in public preview for GitHub Enterprise, organizations, and repositories. This new capability lets enterprise administrators define an allow list that controls who can trigger GitHub Actions workflows and which events are permitted to run them, giving you predictable, secure workflow execution. Previously

When a compromised dependency in a CI/CD job steals your cloud credentials and leaks them, would you catch it? Would you have the logs to investigate afterward? cicd-sensor is an open-source sensor that lets every team answer both. Detection: Detects supply-chain attacks at runtime using process ancestry (e.g. credential access from a process descended from npm install) and correlation across sign

pnpm used to expand ${ENV_VAR} placeholders everywhere it found them — including in the .npmrc and pnpm-workspace.yaml files that live inside the repository you just cloned. That turned out to be a way for a malicious repository to steal the secrets in your environment. As of v10.34.2 and v11.5.3, pnpm stops expanding environment variables in repository-controlled registry and credential settings.

Our next npm major version, v12, introduces security-related default changes to npm install. All these changes are available behind warnings in npm today on 11.16.0 or newer, so you can prepare before the upgrade. v12 is estimated to release in July 2026. Each change turns an npm install behavior that runs automatically today into one you explicitly opt into: allowScripts defaults to off: npm inst