Turn Dependabot off

#1

Post by todsacerdoti » Fri, Feb 20, 2026, 9:25 PM UTC

Re: Turn Dependabot off

#2

Post by samhclark » Fri, Feb 20, 2026, 9:53 PM UTC

This makes sense to me. I guess I'll start hunting for the equivalent of `govulncheck` for Rust/Cargo.

Separately, I love the idea of the `geomys/sandboxed-step` action, but I've got such an aversion to use anyone else's actions, besides the first-party `actions/*` ones. I'll give sandboxed-step a look, sounds like it would be a nice thing to keep in my toolbox.

Re: Turn Dependabot off

#3

Post by literallyroy » Fri, Feb 20, 2026, 9:53 PM UTC

The go ecosystem is pretty good about being backwards compatible. Dependabot regular update prs once a week seems like a good option in addition to govulncheck.

Re: Turn Dependabot off

#4

Post by FiloSottile » Fri, Feb 20, 2026, 9:57 PM UTC

samhclark wrote: post #2

This makes sense to me. I guess I'll start hunting for the equivalent of `govulncheck` for Rust/Cargo. Separately, I love the idea of the `geomys/sandboxed-step` action, but I've got such an aversion to use anyone else's actions, besides the first-party `actions/*` ones. I'll give sandboxed-step a look, sounds like it would be a nice thing to keep in my toolbox.

> I've got such an aversion to use anyone else's actions, besides the first-party `actions/*` ones

Yeah, same. FWIW, geomys/sandboxed-step goes out of its way to use the GitHub Immutable Releases to make the git tag hopefully actually immutable.

Re: Turn Dependabot off

#5

Post by seg_lol » Fri, Feb 20, 2026, 9:57 PM UTC

Be wary of upgrading dependencies too quickly. This is how supply chain incursions are able to spread too quickly. Time is a good firwall.

Re: Turn Dependabot off

#6

Post by bpavuk » Fri, Feb 20, 2026, 10:00 PM UTC

is there a `govulncheck`-like tool for the JVM ecosystem? I heard Gradle has something like that in its ecosystem.

search revealed Sonatype Scan Gradle plugin. how is it?

Re: Turn Dependabot off

#7

Post by Hamuko » Fri, Feb 20, 2026, 10:00 PM UTC

seg_lol wrote: post #5

Be wary of upgrading dependencies too quickly. This is how supply chain incursions are able to spread too quickly. Time is a good firwall.

>Time is a good firwall.

That just reminds me that I got a Dependabot alert for CVE-2026-25727 – "time vulnerable to stack exhaustion Denial of Service attack" – across multiple of my repositories.

Re: Turn Dependabot off

#8

Post by esafak » Fri, Feb 20, 2026, 10:01 PM UTC

seg_lol wrote: post #5

Be wary of upgrading dependencies too quickly. This is how supply chain incursions are able to spread too quickly. Time is a good firwall.

They fixed that last summer: https://github.blog/changelog/2025-07-01-dependabot-supports...

Re: Turn Dependabot off

#9

Post by bpavuk » Fri, Feb 20, 2026, 10:02 PM UTC

samhclark wrote: post #2

This makes sense to me. I guess I'll start hunting for the equivalent of `govulncheck` for Rust/Cargo. Separately, I love the idea of the `geomys/sandboxed-step` action, but I've got such an aversion to use anyone else's actions, besides the first-party `actions/*` ones. I'll give sandboxed-step a look, sounds like it would be a nice thing to keep in my toolbox.

> I guess I'll start hunting for the equivalent of `govulncheck` for Rust/Cargo.

how about `cargo-audit`?

Re: Turn Dependabot off

#10

Post by ImJasonH » Fri, Feb 20, 2026, 10:04 PM UTC

Govulncheck is one of the Go ecosystem's best features, and that's saying something!

I made a GitHub action that alerts if a PR adds a vulnerable call, which I think pairs nicely with the advice to only actually fix vulnerable calls.

https://github.com/imjasonh/govulncheck-action

You can also just run the stock tool in your GHA, but I liked being able to get annotations and comments in the PR.

Incidentally, the repo has dependabot enabled with auto-merge for those PRs, which is IMO the best you can do for JS codebases.