Dependency policy in the agent era

A guided series of 2 articles on Dependency policy in the agent era.

Dependabot's cooldown is the policy your Node repo needed once agents sped up dependency churn — GitHub's new three-day delay matters less as a Dependabot feature than as a supply-chain lesson. In Node and TypeScript repos, dependency freshness now needs a policy: wait on public packages, move faster only by written exception.
The SQLite CVE mess shows where your vulnerability automation needs a gate — A bad advisory turns expensive once scanners, ticket bots, and coding agents treat it as work. The SQLite episode points to a simple boundary: verify provenance and evidence before severity fans out into your pipeline.