GITHUB, PYPI ADD TIME-BASED DEFENSES AGAINST SUPPLY CHAIN ATTACKS

Summary from the TLDR InfoSec newsletter

Dependabot now holds version update pull requests for 72 hours by default so a malicious package flagged minutes after publication has time to be pulled before it lands in a repo.