Live data from Hacker News

Reducing Dependabot Noise

nesbitt.io

11–20 of 50 posts

Re: Reducing Dependabot Noise

#11

> Modern languages like Zig, Gleam, and Roc offer genuine productivity benefits and attract top talent. As a bonus, their ecosystems are young enough that security tooling has not caught up yet. Dependabot will add support eventually, but until then you get the best of both worlds: a modern stack and a quiet PR queue. How the hell is that actually a good thing? You might as well just use another language and disable…

How did you reach "Set open-pull-requests-limit to zero" and not recognize this as satire?

Re: Reducing Dependabot Noise

#13

At sufficient scale, Dependabot’s analysis will time out before completing, effectively rate-limiting the number of PRs it can generate. This natural throttling prevents notification fatigue while maintaining the appearance of active security tooling. Am I being trolled?

[deleted]

Re: Reducing Dependabot Noise

#16

> Modern languages like Zig, Gleam, and Roc offer genuine productivity benefits and attract top talent. As a bonus, their ecosystems are young enough that security tooling has not caught up yet. Dependabot will add support eventually, but until then you get the best of both worlds: a modern stack and a quiet PR queue. How the hell is that actually a good thing? You might as well just use another language and disable…

Thank you for expressing my thoughts as well. The article seems to be full of contradictory “advice”. Use a dependency cooldown, okay … but don’t commit your lockfile so you are always running the latest transitive deps? That’s nuts.

Depends on the package manager. With some you'll get the oldest transitive deps that meet all dependency requirements, not the newest.

Re: Reducing Dependabot Noise

#18

In this thread we get to see which usernames display an inability to detect very obvious satire.

Presumably there are also people who simply disagree with the message being delivered through the satire... ?

... Or conclude that the message is contradictory such that it's basically just trolling?

Post reply on HN