Dependabot

A friendly @GitHub-native robot that helps you keep your dependencies up to date

[April Yoho @TheAprilYoho]

Behind the scenes with @ahpook and @dependabot today at the @ch9 studios.

It's all about supply chain security.

@github #developer #security

[Dependabot @dependabot]

@256BitChris There's a delicate line here, especially recently. Here's our take and the new default behavior for version updates: https://t.co/NTwt2Yddcb wdyt?

[Dependabot @dependabot]

@OmarShahine Glad to be of service 🫡

[Dependabot @dependabot]

@stefannikolei @Aaronontheweb @mjovanovictech Yeah, Dependabot supports grouping!

[Dependabot @dependabot]

@prudentbird all day, every day

[GitHub @github]

Took us a minute, but stacked PRs are now on GitHub 🥞
https://t.co/lT9GGEEDXP

[GitHub @github]

Yes

[GitHub @github]

Maintainers: You don’t need to be a security engineer to improve your project’s security. 🔐

Enable these 6 free GitHub settings in under 30 minutes. 🧵

[GitHub Changelog @GHchangelog]

Dependabot alerts now cover more ecosystems by ingesting malware advisories from the OpenSSF malicious-packages repository.

• Expanded malware data includes npm, PyPI, and more ecosystems

https://t.co/hZS2a7NEQe

[GitHub @github]

4. Enable Dependabot and dependency review

Your project includes code from every package it depends on.

Dependabot alerts you to known vulnerabilities. Dependency review shows what a pull request adds or upgrades and whether those changes introduce vulnerable dependencies.

[Dependabot @dependabot]

@MatureIntellect What could I do to help make your dependency management easier?

[Dependabot @dependabot]

@AlexNoonan6 @vboykis 😀

[Dependabot @dependabot]

@thedatadavis @vboykis yes

[Renovate Bot @renovatebot]

Great to see our friends at Dependabot embracing the on-by-default minimum release age/cooldown functionality!

[Dependabot @dependabot]

@jessfraz

[Dependabot @dependabot]

You can read more about why Dependabot now waits three days before issuing version update pull requests, and how that short wait can help keep malicious releases out of your code. In other words, why cooldowns are...cool https://t.co/NTwt2Yddcb

[Dependabot @dependabot]

@headius 2. If labels are what you’re after, the Labeler action can apply them automatically, and you can customize this to label Dependabot's PRs however you choose: https://t.co/5NUcbJS02I

[Dependabot @dependabot]

@headius Hi! A few ideas: 1. would fewer PRs containing the same updates help? Dependabot supports groups for version and security updates. You can also control updates by package or directory, customize schedules, and more in dependabot.yml: https://t.co/7t10Ahe2Ps

[Dependabot @dependabot]

Stay cool 😎 https://t.co/sE1JRyCmHH

[Dependabot @dependabot]

tl;dr in 60 days, alerts closed 2 or more years ago are moving to archival storage. you will still be able to download them if you need them. https://t.co/eqNoR7jnFf