Two security entries appeared in GitHub's changelog on 28 July. Neither is glamorous and both are more important than the model news that shared the day.
Dependabot now alerts on malicious packages across more ecosystems. GitHub Actions now holds potentially malicious workflows for approval instead of running them.
Why this lands differently in 2026
A year ago a developer chose every dependency deliberately. Now an agent adds packages while you watch, and the review step people skip is exactly the one these defaults reinstate.
Every prompt-to-app tool in this directory — Bolt, Lovable, Base44, Replit, Emergent — installs packages on your behalf. So does Copilot's cloud agent. The volume of dependencies nobody consciously chose has gone up sharply.
What the two changes actually do
- Dependabot: broader ecosystem coverage for known-malicious package alerts, so a poisoned package is flagged in more languages than before
- Actions: a workflow that looks malicious is held for a human to approve rather than executing on push
What to check this week
Neither change requires you to do anything, which is the point of a good default. But two things are worth confirming:
- That Dependabot alerts actually reach a person, not an unread notification channel
- That someone is empowered to approve or reject held workflows, so the queue does not simply block delivery