6 ms·
Dependabot alerts paused for malware advisories
- onionisafruit 4y agoWhat a mess. I don’t understand how they didn’t see this coming.
- nikanj 4y agoWhen this functionality was published, about 0% of comments mentioned this as a possibility
- onionisafruit 4y agoI mean to ask how the GitHub product managers and engineers didn’t catch it. I wouldn’t expect hacker news commenters to pick up on a design defect in the few minutes they spent thinking about this, but in retrospect it seems like something that should have come up in planning or testing.
- smcleod 4y agoHonestly dependabot is so bad I'm surprised anything other than the smallest projects use it, broken upgrades, lack of configurability, no multi-update PRs etc... and it only runs on GitHub. I now recommend Renovate to clients which is also free, but a lot smarter. https://github.com/renovatebot/renovate https://github.com/renovatebot/renovate https://renovatebot.com/ https://renovatebot.com/
- grepfru_it 4y agoEven within github, everyone ignores dependabot updates. Until the security team comes prodding about serious vulnerabilities, no one bats an eye.
- metadat 4y agoIME Dependabot is, at best, annoying. Unless it opens a full-fledged PR with the fixes and a good description of WHY, I don't want it.
- eikenberry 4y agoThat sounds like exactly what it does? How would you describe it?
- metadat 4y agoUsually opens PRs too minor to be worthwhile.
- viraptor 4y agoI guess it depends on the expectations, but I want dependabot to open a PR for every single minor update. The minor ones take a second to see and click merge if your tests are passing. Actually, "too minor" does not exist for me.
- eikenberry 4y agoThey update a single dependency. Pretty much what you'd want I think. Takes <1 minute to skim over the update and merge it. Do you prefer to let your dependency updates build up and update them one a sprint/quarter? I've done that in the past and so far using dependabot (use it at work) seems easier.
- metadat 4y agoI don't like being interrupted randomly by a bot just for a dependency bump. It feels like I'm working for the computer instead of the other way around. To be clear, I'm not arguing to not update vulnerable dependencies, though often enough my project doesn't actually use the vulnerable part of said dependency, effectively making the whole exercise somewhat pointless, akin to virtue signaling for dependencies. Sounds dumb, right? For work projects, I appreciate it. For my open source experiments, not so much. If there was a way to let the bot do everything from beginning to end, merging and possibly breaking everything without manual intervention, that could be exciting! (Probably in a bad way? Milage will surely vary!)
- timw0j 4y agoDid they ever fix the problems with Dependabot and forks of repos using it? That's what turned us off from using it.
- derkoe 4y ago+1 for Renovate - it has support for more languages/ecosystems, it is more configurable and it is fully open source. Anyway, this kind of attack would also work with Renovate but you could create a good company-wide config to prevent this.
- Waterluvian 4y agoThanks for all the #%^*ing branches, Dependabot. I wish you were opt in rather than opt out.
- woojoo666 4y agoI did not realize substitution attacks were so common. Disabling dependabot alerts seems to be sidestepping a major security problem, hopefully Github (and NPM) come up with a more long term solution