3 ms·

https://gitlab.com/dependabot-gitlab/dependabot https://gitlab.com/dependabot-gitlab/dependabot Haven't tried it yet, though.

jacooper 4y ago
Renovate is more complete and fully open source. https://renovatebot.com/ https://renovatebot.com/ But you will need to self host it, the included dependency checks in GitLab are paid. However renovate has a free hosted version for GitHub.
- rarkins 4y ago
  What do you mean by "the included dependency checks"? If you're referring to Renovate, there's no such paid option. If you're referring to GitLab paid features, I'm not sure how that's any different between tools.
- mdaniel 4y ago
  While it may be "fully open source," watch out for its license: https://github.com/renovatebot/renovate/blob/main/license https://github.com/renovatebot/renovate/blob/main/license > Renovate versions 12.0.0 (released 2018-04-09) and onwards are released under the GNU Affero General Public License. The dependabot-gitlab project mentioned above is MIT, for comparison
  - rarkins 4y ago
    Disclosure: Renovate author Renovate is indeed AGPL, but if you're just running it as a CLI, do you think there's anything to "watch out for"? It does not make any project you run it against AGPL, that's for sure. Also you should be aware that dependabot-core, which dependabot-gitlab wraps, is not technically Open Source at all: https://github.com/dependabot/dependabot-core/blob/main/LICENSE https://github.com/dependabot/dependabot-core/blob/main/LICE... Wrapping a non-open source project in another project which claims to be MIT licensed does not change the underlying license. I'm not a lawyer but question the validity of them doing this without larger disclaimers. However, I think that it's likely not something to "watch out for" either. Likely both licensing approaches were intended as a way to forbid or discourage competing services and each project welcomes people self-hosting. In short I don't think that the license of Renovate or Dependabot is likely material for anyone planning to run it for themselves.
    - mdaniel 4y ago
      Thanks for weighing in, and for drawing attention to the wrapped nature of dependabot-gitlab -- I didn't drill down into their implementation As for the "watch out," I apologize if that came across as scolding or whatever, but in my company, and likely quite a few others, AGPL software is forbidden. Thus, maybe I have said "be aware" instead of "watch out," so I'll try to choose more neutral advisory language next time Your "but it's just a CLI" is the nuance of the AGPL that I don't want to pay lawyers to disambiguate since this very thread was about running a GitLab bot, over the network, or in CI which is hosted on runners that connect over the network Maybe I just need to stay out of these threads and let people do their own license homework, but I certainly do get value when someone else makes me aware so I can dismiss the tooling. No good deed goes unpunished, I guess

jacooper 4y ago

Renovate is more complete and fully open source. https://renovatebot.com/ https://renovatebot.com/ But you will need to self host it, the included dependency checks in GitLab are paid. However renovate has a free hosted version for GitHub.

rarkins 4y ago
What do you mean by "the included dependency checks"? If you're referring to Renovate, there's no such paid option. If you're referring to GitLab paid features, I'm not sure how that's any different between tools.
mdaniel 4y ago
While it may be "fully open source," watch out for its license: https://github.com/renovatebot/renovate/blob/main/license https://github.com/renovatebot/renovate/blob/main/license > Renovate versions 12.0.0 (released 2018-04-09) and onwards are released under the GNU Affero General Public License. The dependabot-gitlab project mentioned above is MIT, for comparison
- rarkins 4y ago
  Disclosure: Renovate author Renovate is indeed AGPL, but if you're just running it as a CLI, do you think there's anything to "watch out for"? It does not make any project you run it against AGPL, that's for sure. Also you should be aware that dependabot-core, which dependabot-gitlab wraps, is not technically Open Source at all: https://github.com/dependabot/dependabot-core/blob/main/LICENSE https://github.com/dependabot/dependabot-core/blob/main/LICE... Wrapping a non-open source project in another project which claims to be MIT licensed does not change the underlying license. I'm not a lawyer but question the validity of them doing this without larger disclaimers. However, I think that it's likely not something to "watch out for" either. Likely both licensing approaches were intended as a way to forbid or discourage competing services and each project welcomes people self-hosting. In short I don't think that the license of Renovate or Dependabot is likely material for anyone planning to run it for themselves.
  - mdaniel 4y ago
    Thanks for weighing in, and for drawing attention to the wrapped nature of dependabot-gitlab -- I didn't drill down into their implementation As for the "watch out," I apologize if that came across as scolding or whatever, but in my company, and likely quite a few others, AGPL software is forbidden. Thus, maybe I have said "be aware" instead of "watch out," so I'll try to choose more neutral advisory language next time Your "but it's just a CLI" is the nuance of the AGPL that I don't want to pay lawyers to disambiguate since this very thread was about running a GitLab bot, over the network, or in CI which is hosted on runners that connect over the network Maybe I just need to stay out of these threads and let people do their own license homework, but I certainly do get value when someone else makes me aware so I can dismiss the tooling. No good deed goes unpunished, I guess