Live data from Hacker News

Dependabot is joining GitHub

dependabot.com

31–40 of 47 posts

Re: Dependabot is joining GitHub

#31
post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

GitLab first nudged everyone in this direction I think.

Re: Dependabot is joining GitHub

#32
Congrats to the Dependabot team!

I've had the pleasure of reaching out to Dependabot a few times when I've had issues or problems and you guys have always been super responsive and quick to fix any bugs!

Congrats again on joining Github! And excited to see whats next for Dependabot!

Re: Dependabot is joining GitHub

#35

Curious about the side effects of this. Imagine you had an open source project that was just something on the side or you worked on in a different life. And then you see pull requests for updates and decide to fix a bug here or there. And then maybe it prompts you to recommit to it. If that were to apply to even a tiny percentage across all of Github could have major implications for open source as a whole.

This is absolutely a thing. I've ignored something until heroku let me know it's on such an old platform version, it'll keep running but not restart. So I've given it an update recently.

I gave one of my projects a bit of an update after someone mentioned a part of it was no longer working. I enjoy those kinds of reminders as it reminds me some people still use it.

Re: Dependabot is joining GitHub

#36
post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

They might see GitLab as a threat (GitLab itself aims to be an all-in-one platform) and are taking steps to up their game.

Re: Dependabot is joining GitHub

#37
post #8
post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

> But: all the built-in tools will have an inherent advantage over third party solutions. This inevitably leads to increased lock-in and homogenization. There's no lock-in, you can continue whatever integrations or pipeline you have now. This just gives an easier option. Them offering Github Pages isn't lock-in to their hosting, but it offers convenience in various scenerios.

It disincentivizes GitHub from maintaining feature parity of the API for integrators with what is available through UI.

Re: Dependabot is joining GitHub

#38
post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

When I built GitButler[0], I did so fully expecting that GitHub might come one day and kill it by providing a better integrated solution. That's the natural order of things, ultimately, whoever owns the platform, controls it and 3rd parties can't do much. That's also the reason I've shifted my attention more towards open platforms lately.

[0] https://www.gitbutler.com

Re: Dependabot is joining GitHub

#39
post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

it was never "neutral" or "open" in any real sense;

at the same time there is no real reason to fear github that I can see - until it starts claiming ownership of your code or inserting spyware into your downloads or something more subtle

Re: Dependabot is joining GitHub

#40
post #11
post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

If the increase in homogenization comes from everyone keeping their packages up to date and secure, I'm going to see that as a net win for the community.

I don't see vendor lock-in as a net win for anyone but the vendor.
Post reply on HN