In this thread we get to see which usernames display an inability to detect very obvious satire.
It got me until "Remove lockfiles from version control"
Reducing Dependabot Noise
41–50 of 50 posts
Re: Reducing Dependabot Noise
#42I gotta admit you had me thinking this was serious until the `Remove lockfiles` section ;)
Not "you can always rewrite it yourself in Rust over a weekend"?
Re: Reducing Dependabot Noise
#43Take a look at pr-bot:
https://github.com/marqeta/pr-bot
The answer to dependabot, or snyk prs is to automatically merge them once all the status checks pass.
This free your devs from having to worry about patching.
PR-BOT will let you define policy on when it’s ok to automerge prs.
Re: Reducing Dependabot Noise
#44[deleted]
Re: Reducing Dependabot Noise
#45try reducing dependencies.
Re: Reducing Dependabot Noise
#46Take a look at pr-bot: https://github.com/marqeta/pr-bot The answer to dependabot, or snyk prs is to automatically merge them once all the status checks pass. This free your devs from having to worry about patching. PR-BOT will let you define policy on when it’s ok to automerge prs.
I don’t have experience with dependabot at all. I didn’t realize it was satire. I just kept thinking, “This sounds like terrible advice. This can’t be right.”
Re: Reducing Dependabot Noise
#47I gotta admit you had me thinking this was serious until the `Remove lockfiles` section ;)
Not "you can always rewrite it yourself in Rust over a weekend"?
"If it has been mass maintained by some random person in Nebraska since 2003, that is battle-tested infrastructure." comes before that.
Re: Reducing Dependabot Noise
#48Take a look at pr-bot: https://github.com/marqeta/pr-bot The answer to dependabot, or snyk prs is to automatically merge them once all the status checks pass. This free your devs from having to worry about patching. PR-BOT will let you define policy on when it’s ok to automerge prs.
I don’t have experience with dependabot at all. I didn’t realize it was satire. I just kept thinking, “This sounds like terrible advice. This can’t be right.”
This is not satire.
If you have a large dependency graph, you are going to have a lot of vulnerable stuff.
Letting one computer send you patches and the other computer merge it for you when all your tests pass is a good thing.
Re: Reducing Dependabot Noise
#49In this thread we get to see which usernames display an inability to detect very obvious satire.
It got me until "Remove lockfiles from version control"
My favorite was
If it has been mass maintained by some random person in Nebraska since 2003, that is battle-tested infrastructure.
Re: Reducing Dependabot Noise
#50I added the suggested dependabot.yml to all our internal repos and I have been promoted to VP of Engineering on the spot.
Congratulations, well deserved. 100x impact.