Automate GitHub Dependency Updates with Dependabot

Re:Automate GitHub Dependency Updates with Dependabot by jakear on Tuesday December 31, 2019 @01:39PM (#21923272)

Discussion from last week where dependabot was proposed as a solution to the issue of third party contributors sneaking exploits into package-lock changes: https://news.ycombinator.com/item?id=21886914

My stance is still "if there's no CVE, and your application works, why go around introducing changes to the environment you're running it in?"

[ Parent | on HN ]

Re:Automate GitHub Dependency Updates with Dependabot by palijer on Tuesday December 31, 2019 @02:00PM (#21923510)

Doing gradual smaller changes over time and reducing the delta removes the risk of having to update everything at once down the road. We use dependabot to prevent our services from becoming the legacy issues that no one wants to touch.

We'd rather fix small issues continuously than have giant overhauls when a bunch of packages need to get updated because we weren't staying on top of it.

I think about it like a CD pipeline for dep updates. Less risk if you ship smaller amounts of code.

[ Parent | on HN ]