Dependabot

“I've had some frustration lately with Dependabot pings on "completed" repos for dev dependencies that don't affect runtime.”

“Dependabot will watch for new versions and submit a PR for free.”

“I didn't like the way it created a pipeline for any hacker to push a hacked dependency straight into someone's codebase”

“they are still not fun to deal with when you have to write NIS2 compliance documentation”

“So so so many "regular expression denial-of-service" issues at my last job that just didn't seem serious or often reachable.”

“But updates to broken packages are still allowed: if a new version is pushed within the three days, it does not reset the cool-down.”

“For mechanical work–things like bumping versions, fixing failing tests”

“The cooldown setting in dependabot solves this attack vector.”

“you can just have dependabot create the PRs to update packages”

“For dependabot it's as simple as cooldown.default-days: 1”

“auto Dependabot PRs that encourage churn to fix issues that if an informed person actually reviews easily concludes it doesn't affect us”

“You should be using CI to manage updates of lock files (e.g. dependabot, renovate)”

“Dependabot avalanche (a small repo I check in on has 15+ open dep bumps, half with stale merge conflicts”

“This is a (ridiculous, IMO) platform limitation that GitHub could lift by applying more engineering time to Dependabot”

“Services like renovate and dependabot do this lifting at no cost to the js developer, and probably do it better.”

“tell dependabot to delay a week, you'd sleep easy from this nonesense”

“Renovate and Dependabot can update pinned SHA references in workflows automatically”

“one of the benefits of Dependabot (and Renovate) are that they are language-agnostic”

“those automated PRs pile up into noise”

“I have found a reliable way to keep things up-to-date is enabling dependabot and merging relentlessly”

“Dependabot’s built-in vulnerability scanning is strictly worse than just about every ecosystem’s own built-in solution.”

“it only tells you that you're using a version that was vulnerable, not that you're using a specific API that was vulnerable”

“The emails are annoying and I mostly filter”

“having Dependabot update dependencies automatically after a cooldown still seems like a better alternative”

“The number of ReDoS vulnerabilities we see in Dependabot alerts for NPM packages we’re only using in client code is absurd.”

“What's nice about Dependabot is that it works across multiple languages and platforms.”

“Dependabot regular update prs once a week seems like a good option”

“Letting one computer send you patches and the other computer merge it for you when all your tests pass is a good thing.”

“I added the suggested dependabot.yml to all our internal repos”

“These dependabot MRs aren't even fixing real security issues, these do not exist in the wild.”

“At sufficient scale, Dependabot’s analysis will time out before completing, effectively rate-limiting the number of PRs it can generate.”

“Overall, this seems an improvement over spamming PRs that I may not care about”

“GitHub spammed me with notifications from it.”

“Before I joined Mend to work on Renovate, I wrote a post which goes into some ways I found Renovate better than Dependabot”

“Dependabot integrates decently well with Github of course but so far renovate has worked well for us.”

“It is quite slow to get support for newer conventions that are not ubiquitous across all of github.”

“We started by having it doing PR for every single dependencies update every day, but that was a little too much noise”

“Use Dependabot to keep dependencies up to date, but configure a dependency cooldown so you don't end up installing anything too new.”

“Dependabot (and probably others) don't consider cooldown when suggesting security upgrades”

“We offer a Github app that integrates with alerts from Dependabot.”