<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>🔐 DevSecOps on m58 | DevSecOps &amp; Pentest</title><link>https://0xm58.xyz/categories/devsecops/</link><description>Recent content in 🔐 DevSecOps on m58 | DevSecOps &amp; Pentest</description><generator>Hugo -- gohugo.io</generator><language>en</language><lastBuildDate>Sun, 16 Aug 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://0xm58.xyz/categories/devsecops/index.xml" rel="self" type="application/rss+xml"/><item><title>DevSecOps: dependency updates without noise</title><link>https://0xm58.xyz/posts/devsecops-dependency-updates-without-noise/</link><pubDate>Sun, 16 Aug 2026 00:00:00 +0000</pubDate><guid>https://0xm58.xyz/posts/devsecops-dependency-updates-without-noise/</guid><description>&lt;div class="lead text-neutral-500 dark:text-neutral-400 !mb-9 text-xl"&gt;
 Dependency updates are security work, but only if the process is quiet enough that people keep reading the diffs.
&lt;/div&gt;

&lt;p&gt;The usual failure mode is not a missing bot. It is too many pull requests, no triage, and no clear rule for what gets merged first.&lt;/p&gt;</description></item></channel></rss>