3 ms·
Don't update your dependencies manually. Setup renovate to do it for you, with a delay of at least a couple of weeks, and enable vulnerability alerts so that it
by homebrewer 1y ago
Don't update your dependencies manually. Setup renovate to do it for you, with a delay of at least a couple of weeks, and enable vulnerability alerts so that it opens PRs for publicly known vulnerabilities without delay
https://docs.renovatebot.com/configuration-options/#minimumreleaseage https://docs.renovatebot.com/configuration-options/#minimumr...
https://docs.renovatebot.com/presets-default/#enablevulnerabilityalerts https://docs.renovatebot.com/presets-default/#enablevulnerab...
- collinmanderson 1y agoWhy was this comment downvoted? Please explain why you disagree.
- biggusdickus69 1y agoI didn’t downvote, but... Depending on a commercial service is out of the question for most open source projects.
- isbvhodnvemrwvn 1y agoRenovate is not commercial, it's an own source dependabot, quite more copable at that.
- wereHamster 1y agoAGPL is a no-go for many companies (even when it's just a tool that touches your code and not a dependency you link to).
- 1oooqooq 1y agogood. that's the point. agpl is a no go for companies not intending to ever contribute anything back. good riddance.