Dependabot is joining GitHub
dependabot.com
Dependabot is joining GitHub
1–10 of 47 posts
Re: Dependabot is joining GitHub
#2Microsoft really is growing GitHub. I can't say I'm not pleasantly surprised.
Re: Dependabot is joining GitHub
#3Curious about the side effects of this.
Imagine you had an open source project that was just something on the side or you worked on in a different life. And then you see pull requests for updates and decide to fix a bug here or there. And then maybe it prompts you to recommit to it.
If that were to apply to even a tiny percentage across all of Github could have major implications for open source as a whole.
Re: Dependabot is joining GitHub
#4Curious about the side effects of this. Imagine you had an open source project that was just something on the side or you worked on in a different life. And then you see pull requests for updates and decide to fix a bug here or there. And then maybe it prompts you to recommit to it. If that were to apply to even a tiny percentage across all of Github could have major implications for open source as a whole.
This is absolutely a thing. I've ignored something until heroku let me know it's on such an old platform version, it'll keep running but not restart. So I've given it an update recently.
Re: Dependabot is joining GitHub
#5Curious about the side effects of this. Imagine you had an open source project that was just something on the side or you worked on in a different life. And then you see pull requests for updates and decide to fix a bug here or there. And then maybe it prompts you to recommit to it. If that were to apply to even a tiny percentage across all of Github could have major implications for open source as a whole.
I think existing repo will get nothing but maybe something will be enabled by default for new repo
Which is good for open source repos
I enabled Dependabot for my main OS projects just now
Re: Dependabot is joining GitHub
#6Edit: copy/pasting my more extensive comment from the Sponsors thread.
All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot).
But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" dev tool and platform.
I understand the internal pressures to do this: increased popularity, added value proposition for customers, more revenue.
But: all the built-in tools will have an inherent advantage over third party solutions. This inevitably leads to increased lock-in and homogenization.
I was very critical of the Microsoft acquisition for similar reasons, and considering the monumental role Github represents for open source today, I am very sceptical of the way things are going.
We might very well regret centralizing everything open source around Github in a few years.
Re: Dependabot is joining GitHub
#7Huge congrats to Dependabot team! If you're starting a new project in Python (+ others), having Dependabot + CircleCI (or something equivalent) + Strong test coverage will save you hundreds of hours (eventually).
Best trick is to make sure your test coverage is strong early (I know this is easier said than done ...), then you can just merge updated requirements without ever worrying.
GitHub has a type of service that would check requirements already, it just never felt as polished as Dependabot. But it goes to show how far a committed team can prioritize over bigger players. IIRC, they still use Heroku, which seems like a lot of discipline in prioritizing the right product features over just building tech stacks in BigCloudProviders.
Re: Dependabot is joining GitHub
#8Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…
> But: all the built-in tools will have an inherent advantage over third party solutions. This inevitably leads to increased lock-in and homogenization.
There's no lock-in, you can continue whatever integrations or pipeline you have now. This just gives an easier option. Them offering Github Pages isn't lock-in to their hosting, but it offers convenience in various scenerios.
Re: Dependabot is joining GitHub
#9Microsoft really is growing GitHub. I can't say I'm not pleasantly surprised.
The bush in my backyard is growing too, similar to the PHP API surface circa PHP5, not every growth is a good thing. I am very cautious of what is to become of Github in a couple of years.
Re: Dependabot is joining GitHub
#10Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…
I would agree if this came with changes that would block out newcomers. But third parties can still build just as they always have been.
As a user, I like that new features are now free instead of paid plugins.
I see this more as trying to get to parity with GitLab with a function of more advanced maturity with cloud computing that’s making it cheaper for Github to run more scheduled task type stuff (scanning and alerting workflow).
I think it will be hard for third parties to compete with free, but it’s kind of like with phones added flashlight to the OS. Sucked for the flashlight app makers.
That being said, I think like will be rough for TravisCI and all the web based software PM products as this is an area where GitLab has more features than GitHub and I think they’ll be growing.