5 ms·

I've built something like this for Python projects. You add your repo and a bot is constantly checking for insecure and/or outdated packages and sends you a pu

by jayfk 10y ago

I've built something like this for Python projects. You add your repo and a bot is constantly checking for insecure and/or outdated packages and sends you a pull request if you need to update. It's free for open source projects at https://pyup.io https://pyup.io

po 10y ago
We've been using pyup for a few months now and it's awesome. Thank you. I was initially concerned that constant PR's for dependencies would be too noisy for our team but it turned out that it's configurable enough and gracefully handles us ignoring or closing PR's that we evaluate and decide to wait on. It's a great service that all python developers should be using. (I say that because I want as many pyup users as possible so it never goes away)
nathancahill 10y ago
Similar to Greenkeeper.io for npm?
luhn 10y ago
Bookmarking this. I recently was alerted to a CRLF injection vulnerability on the service I manage because an outdated dependency was vulnerable. This could have nipped that in the bud.
lumpypua 10y ago
Just signed up and discovered a vulnerability. Thanks! A quick suggestion, consider adding a full sample configuration along with your config docs: https://pyup.io/docs/configuration/ https://pyup.io/docs/configuration/ It's a lot easier to see how it all sits together with a sample. CircleCI has a great example: https://circleci.com/docs/1.0/config-sample/ https://circleci.com/docs/1.0/config-sample/
notheguyouthink 10y ago
Is there something like this for all languages / os / etc? Seems like an amazing tool to poll against.
nkuttler 10y ago
Why does your service ask for write access to my repos?
- jayfk 10y ago
  For the pull request. The bot creates a branch, commits the changes and sends you a pull request on your repo. This it how it looks like: https://github.com/pydanny/cookiecutter-django/pull/1065 https://github.com/pydanny/cookiecutter-django/pull/1065
  - nkuttler 10y ago
    Thanks for the reply. I guess forking each repo wouldn't scale well?

by jayfk 10y ago

po 10y ago

We've been using pyup for a few months now and it's awesome. Thank you. I was initially concerned that constant PR's for dependencies would be too noisy for our team but it turned out that it's configurable enough and gracefully handles us ignoring or closing PR's that we evaluate and decide to wait on. It's a great service that all python developers should be using. (I say that because I want as many pyup users as possible so it never goes away)

nathancahill 10y ago

Similar to Greenkeeper.io for npm?

luhn 10y ago

Bookmarking this. I recently was alerted to a CRLF injection vulnerability on the service I manage because an outdated dependency was vulnerable. This could have nipped that in the bud.

lumpypua 10y ago

Just signed up and discovered a vulnerability. Thanks! A quick suggestion, consider adding a full sample configuration along with your config docs: https://pyup.io/docs/configuration/ https://pyup.io/docs/configuration/ It's a lot easier to see how it all sits together with a sample. CircleCI has a great example: https://circleci.com/docs/1.0/config-sample/ https://circleci.com/docs/1.0/config-sample/

notheguyouthink 10y ago

Is there something like this for all languages / os / etc? Seems like an amazing tool to poll against.

nkuttler 10y ago

Why does your service ask for write access to my repos?

jayfk 10y ago
For the pull request. The bot creates a branch, commits the changes and sends you a pull request on your repo. This it how it looks like: https://github.com/pydanny/cookiecutter-django/pull/1065 https://github.com/pydanny/cookiecutter-django/pull/1065
- nkuttler 10y ago
  Thanks for the reply. I guess forking each repo wouldn't scale well?