3 ms·
Actually, the conda-forge bot does more than that; From https://github.com/regro/cf-scripts/issues/3920#issuecomment-2746675003 https://github.com/regro/cf-scr
by westurner 2y ago
Actually, the conda-forge bot does more than that;
From https://github.com/regro/cf-scripts/issues/3920#issuecomment-2746675003 https://github.com/regro/cf-scripts/issues/3920#issuecomment... re: (now github) dependabot maybe someday scanning conda environment.yml, conda-lock.yml, and/or feedstock meta.yml:
> So the bot here does a fair bit more than update dependencies and/or versions.
> We have globally pinned ABIs which have to migrated in a specific order. We also use the bot here to start the migrations, produce progress / error outputs on the status page, and then close the migrations. The bot here also does specific migrations of dependencies that have been renamed, recipe maintenance, and more.
Dependabot scans for vulnerable software package versions in software dependency specification documents for a number of languages and package formats, when you git push to a repo which has dependabot configured in their dependabot.yml:
From the dependabot.yml docs: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem- https://docs.github.com/en/code-security/dependabot/working-... :
> Define one package-ecosystem element for each package manager that you want Dependabot to monitor for new versions
Dependabot supports e.g. npm, pip, gomod, cargo, docker, github-actions, devcontainers,
SBOM tools have additional methods of determining which packages are installed on a specific server or container instance.
Static sites are sometimes build and forget projects that also need regular review of the statically-compiled-in dependencies for known vulns.
E.g. jupyterlite-xeus builds WASM static sites from environment.yml; though Hugo is probably much faster.