Bringing supply chain security features to the Go community
1–10 of 72 posts
Re: Bringing supply chain security features to the Go community
#2GitHub's dependabot is causing a ton of "spam" in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories.
Is there an option to tell dependabot "make one PR per week at most, please, and bundle your changes"?
Re: Bringing supply chain security features to the Go community
#3GitHub's dependabot is causing a ton of "spam" in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories. Is there an option to tell dependabot "make one PR per week at most, please, and bundle your changes"?
Part of that is the Node / JS ecosystem that churns out libraries for every tiny thing. The Go ecosystem is a lot more streamlined; adding dependencies is frowned upon, building small libraries is frowned upon, etc.
That said, if it's just version bumps then they should be bundled. But what about security issues? Those need to be fixed and updated asap.
Re: Bringing supply chain security features to the Go community
#4GitHub's dependabot is causing a ton of "spam" in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories. Is there an option to tell dependabot "make one PR per week at most, please, and bundle your changes"?
Here's some information on these "vulnerabilities": https://overreacted.io/npm-audit-broken-by-design/
As far as I'm concerned, there's no need for Dependabot to create PRs. The notifications in the security tab are enough. Mark the unnecessary ones as benign.
Re: Bringing supply chain security features to the Go community
#5GitHub's dependabot is causing a ton of "spam" in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories. Is there an option to tell dependabot "make one PR per week at most, please, and bundle your changes"?
The amount of pull requests from dependency updates can become more manageable if you enable GitHub’s Auto Merge feature[1]
[1] https://docs.github.com/en/github/collaborating-with-pull-re...
Re: Bringing supply chain security features to the Go community
#6GitHub's dependabot is causing a ton of "spam" in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories. Is there an option to tell dependabot "make one PR per week at most, please, and bundle your changes"?
This seems like good motivation to prune your dependencies if they’re getting out of hand. Of course, easier said than done, but at an ecosystem level maybe it will help?
Re: Bringing supply chain security features to the Go community
#7GitHub's dependabot is causing a ton of "spam" in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories. Is there an option to tell dependabot "make one PR per week at most, please, and bundle your changes"?
Disable it. If you don’t want to, limit it to weekly or monthly. I agree that Dependabot is super noisy especially by default.
Re: Bringing supply chain security features to the Go community
#8GitHub's dependabot is causing a ton of "spam" in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories. Is there an option to tell dependabot "make one PR per week at most, please, and bundle your changes"?
This seems like good motivation to prune your dependencies if they’re getting out of hand. Of course, easier said than done, but at an ecosystem level maybe it will help?
Well angular repositories tend to have tons of dependencies.
Re: Bringing supply chain security features to the Go community
#9GitHub's dependabot is causing a ton of "spam" in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories. Is there an option to tell dependabot "make one PR per week at most, please, and bundle your changes"?
The amount of pull requests from dependency updates can become more manageable if you enable GitHub’s Auto Merge feature[1] [1] https://docs.github.com/en/github/collaborating-with-pull-re...
Exactly what you want to have: get a bot merge fixes for security issues prepared by another bot without any human oversight. Then let Copilot add features to your software automatically as well.
Re: Bringing supply chain security features to the Go community
#10meh. well that disappointing, its basically dependabot / graph and advisories.