4 ms·

Honestly dependabot is so bad I'm surprised anything other than the smallest projects use it, broken upgrades, lack of configurability, no multi-update PRs etc.

Honestly dependabot is so bad I'm surprised anything other than the smallest projects use it, broken upgrades, lack of configurability, no multi-update PRs etc... and it only runs on GitHub. I now recommend Renovate to clients which is also free, but a lot smarter. https://github.com/renovatebot/renovate https://github.com/renovatebot/renovate https://renovatebot.com/ https://renovatebot.com/

grepfru_it 4y ago
Even within github, everyone ignores dependabot updates. Until the security team comes prodding about serious vulnerabilities, no one bats an eye.
metadat 4y ago
IME Dependabot is, at best, annoying. Unless it opens a full-fledged PR with the fixes and a good description of WHY, I don't want it.
- eikenberry 4y ago
  That sounds like exactly what it does? How would you describe it?
  - metadat 4y ago
    Usually opens PRs too minor to be worthwhile.
    - viraptor 4y ago
      I guess it depends on the expectations, but I want dependabot to open a PR for every single minor update. The minor ones take a second to see and click merge if your tests are passing. Actually, "too minor" does not exist for me.
    - eikenberry 4y ago
      They update a single dependency. Pretty much what you'd want I think. Takes <1 minute to skim over the update and merge it. Do you prefer to let your dependency updates build up and update them one a sprint/quarter? I've done that in the past and so far using dependabot (use it at work) seems easier.
      - metadat 4y ago
        I don't like being interrupted randomly by a bot just for a dependency bump. It feels like I'm working for the computer instead of the other way around. To be clear, I'm not arguing to not update vulnerable dependencies, though often enough my project doesn't actually use the vulnerable part of said dependency, effectively making the whole exercise somewhat pointless, akin to virtue signaling for dependencies. Sounds dumb, right? For work projects, I appreciate it. For my open source experiments, not so much. If there was a way to let the bot do everything from beginning to end, merging and possibly breaking everything without manual intervention, that could be exciting! (Probably in a bad way? Milage will surely vary!)
        viraptor 4y ago
        > Sounds dumb, right? Realistically, no, I don't think so. You're making a choice between updating everything as soon as possible, or batching everything until it's actually needed. Both valid approaches, but I prefer the first. It saves you when one day you discover that you really need to do some critical update... but now it also depends on updates to foo, bar and baz, and changes to your code because some API got deprecated and you need to figure out how they impacts your external interface. I'd rather deal with 100 trivial/pointless updates trickling in daily instead of one of those situations.
        lozenge 4y ago
        Supply chain attacks are already scary enough, but with package updates being auto merged into tens of thousands of GitHub repositories? Oof!
timw0j 4y ago
Did they ever fix the problems with Dependabot and forks of repos using it? That's what turned us off from using it.
derkoe 4y ago
+1 for Renovate - it has support for more languages/ecosystems, it is more configurable and it is fully open source. Anyway, this kind of attack would also work with Renovate but you could create a good company-wide config to prevent this.

grepfru_it 4y ago

Even within github, everyone ignores dependabot updates. Until the security team comes prodding about serious vulnerabilities, no one bats an eye.

metadat 4y ago

IME Dependabot is, at best, annoying. Unless it opens a full-fledged PR with the fixes and a good description of WHY, I don't want it.

eikenberry 4y ago
That sounds like exactly what it does? How would you describe it?
- metadat 4y ago
  Usually opens PRs too minor to be worthwhile.
  - viraptor 4y ago
    I guess it depends on the expectations, but I want dependabot to open a PR for every single minor update. The minor ones take a second to see and click merge if your tests are passing. Actually, "too minor" does not exist for me.
  - eikenberry 4y ago
    They update a single dependency. Pretty much what you'd want I think. Takes <1 minute to skim over the update and merge it. Do you prefer to let your dependency updates build up and update them one a sprint/quarter? I've done that in the past and so far using dependabot (use it at work) seems easier.
    - metadat 4y ago
      I don't like being interrupted randomly by a bot just for a dependency bump. It feels like I'm working for the computer instead of the other way around. To be clear, I'm not arguing to not update vulnerable dependencies, though often enough my project doesn't actually use the vulnerable part of said dependency, effectively making the whole exercise somewhat pointless, akin to virtue signaling for dependencies. Sounds dumb, right? For work projects, I appreciate it. For my open source experiments, not so much. If there was a way to let the bot do everything from beginning to end, merging and possibly breaking everything without manual intervention, that could be exciting! (Probably in a bad way? Milage will surely vary!)
      - viraptor 4y ago
        > Sounds dumb, right? Realistically, no, I don't think so. You're making a choice between updating everything as soon as possible, or batching everything until it's actually needed. Both valid approaches, but I prefer the first. It saves you when one day you discover that you really need to do some critical update... but now it also depends on updates to foo, bar and baz, and changes to your code because some API got deprecated and you need to figure out how they impacts your external interface. I'd rather deal with 100 trivial/pointless updates trickling in daily instead of one of those situations.
      - lozenge 4y ago
        Supply chain attacks are already scary enough, but with package updates being auto merged into tens of thousands of GitHub repositories? Oof!

timw0j 4y ago

Did they ever fix the problems with Dependabot and forks of repos using it? That's what turned us off from using it.

derkoe 4y ago

+1 for Renovate - it has support for more languages/ecosystems, it is more configurable and it is fully open source. Anyway, this kind of attack would also work with Renovate but you could create a good company-wide config to prevent this.