3 ms·
Vendoring is totally a thing you can do, but keeping them up to date with upstream (and keeping your bazel BUILD files current) is a full time job. You have to
by habitue 8y ago
Vendoring is totally a thing you can do, but keeping them up to date with upstream (and keeping your bazel BUILD files current) is a full time job. You have to hire someone to do that work, it's not completely automatable.
- vageli 8y agoNon-security upgrades probably _shouldn't_ be automated.
- habitue 8y agoAbsolutely agree. But I meant maintaining BUILD files for code you didn't write can be very time consuming. Even a security-only update can include new source files that you now have to tell Bazel about. It's real work