4 ms·
Article is all about dependencies. And it only mentions JavaScript. So maybe a better topic would be: "How to use GitHub dependency tool to secure your Javascri
by mcraiha 4y ago
Article is all about dependencies. And it only mentions JavaScript. So maybe a better topic would be: "How to use GitHub dependency tool to secure your Javascript project"
- Dragory 4y agoIt looks like they support other package ecosystems as well: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems https://docs.github.com/en/code-security/supply-chain-securi... That said, the article does indeed seem to focus entirely on dependencies.
- cebert 4y agoI’ve noticed Dependabot isn’t always even the greatest for JS projects. There are popular front-end frameworks such as Angular or React. When it makes PRs for currency updates, it seems unaware that it should update all packages for a particular framework or update @types imports when it updates a package import.
- jhutchings0 4y agoHi from the Dependabot team! We're working on a fix for the Typescript @types problem that should be available very soon.