New tool pin-deep checks for unpinned dependencies in GitHub Actions workflows

·1 views

A new tool called pin-deep has been released to address security gaps in GitHub Actions dependency pinning. It was developed following the tj-actions incident (CVE-2025-30066), where a compromise spread via an unpinned nested dependency. The tool recursively analyzes the action.yml files of SHA-pinned actions to flag any nested dependencies not pinned to a full commit SHA. It is designed to integrate into CI/CD pipelines and defaults to checking three dependency levels deep. The tool is available on PyPI and GitHub as a dependency-free Python utility.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Salesforce Marketing Cloud success hinges on data architecture, not campaign setup

A Salesforce Marketing Cloud implementation often fails due to underlying data issues, not campaign design. Many projects launch quickly but later struggle with irrelevant messaging and faulty segments because of poor data foundations. The core challenge is integrating reliable customer data, resolving identities across systems, and ensuring proper consent. Salesforce recommends treating data, identity, and integration as a unified architecture before building campaigns. The platform should use a selective, shared dataset rather than attempting to manage all customer information internally.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hyperlocal marketplaces challenge major e-commerce giants in India

Hyperlocal marketplaces connect consumers with products from nearby physical shops rather than distant warehouses. Platforms like FRQ provide small retailers with personalized online storefronts, allowing them to establish a digital presence. These services address a demand in Tier 2 and 3 cities for online convenience combined with the trust of local, visitable shops. The model utilizes complex technical solutions, such as geospatial queries, to match shoppers with neighborhood inventory.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Software testing experts advocate for balanced quality engineering over full automation

A software development article argues that while automation is valuable, relying on it as the sole testing strategy can miss critical quality issues like usability, accessibility, and unexpected real-world behavior. The piece advocates for a balanced approach called quality engineering, which integrates multiple testing methods throughout the development lifecycle. It recommends combining unit tests, API testing, UI automation, exploratory human testing, and AI-assisted workflows to create a complete quality picture. The goal is to apply the most effective method for each type of risk, rather than automating every interaction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Paint.NET ported from C# to JavaScript for Linux and browser use

A developer has ported the image editing software Paint.NET from C# to JavaScript. The project was initiated to make the tool accessible on Linux systems and in web browsers, where it was previously unavailable. The work used an open-source version of Paint.NET as its legal and technical foundation. The final product runs both in browsers and as a desktop application via the Electron framework. The developer addressed performance challenges inherent in JavaScript, such as graphics rendering latency.

0 comments Read more at DEV Community