News for hackers. Stuff that matters.

A comment on Automate GitHub Dependency Updates with Dependabot. Parent comment

Re:Automate GitHub Dependency Updates with Dependabot by capableweb on Tuesday December 31, 2019 @03:42PM (#21924561)
Instead of throwing your hands in the air and saying "Well, too many dependencies, can't review it", you can pull in less dependencies so you can manage to review it. Especially from sources where anyone can publish anything basically.
[ Parent | on HN ]
Re:Automate GitHub Dependency Updates with Dependabot by lowdose on Tuesday December 31, 2019 @09:46PM (#21926322)
Don't use npm?
[ Parent | on HN ]
Re:Automate GitHub Dependency Updates with Dependabot by capableweb on Wednesday January 01, 2020 @11:26AM (#21928712)
Not sure if this is a statement or question. Assuming it's a question: Me and my team uses npm, but we're careful about what we pull in. If the dependency has too many dependencies themselves, we either find a alternative, fork it to remove bunch of stuff we don't care about or write something ourselves.
[ Parent | on HN ]