4 ms·
I don't think it's too hot a take, but it is incorrect. Dependabot Alerts (and Updates) are required on all internal services and folks use them (and provide si
by asciimike 5y ago
I don't think it's too hot a take, but it is incorrect. Dependabot Alerts (and Updates) are required on all internal services and folks use them (and provide similar feedback).
Dependabot Alerts is working on some of these things, starting with e.g. https://github.blog/changelog/2022-02-08-dependabot-alerts-persisted-after-fix-now-one-per-advisory/ https://github.blog/changelog/2022-02-08-dependabot-alerts-p...
I know that security alerts in general are working on ways of assigning alerts (or opening issues that reference those alerts)--hopefully this is something that will show up soon.
(Disclosure: former Dependabot PM, no longer work at GitHub)
- lloydatkinson 5y agoDo you know why a repo might be getting dependabot alerts when it used to have them setup, but now it doesn't, yet still gets them randomly?
- asciimike 5y agoHate to say it but have you tried turning it on and off again? IIRC sometimes the state of alerts got stuck in a weird place and resulted in the incorrect state. Toggling it might put it back into the desired state. I'd also check and make sure Updates is turned off (delete the dependabot.yml).
- lloydatkinson 5y agoWell there's no yml file at all which is the confusing part but I suppose I could try make a blank one