Re:Bringing supply chain security features to the Go community
by jacobparker on Friday July 23, 2021 @10:53AM
(#27931346)
For NuGet, consider using centralized package references: https://github.com/NuGet/Home/wiki/Centrally-managing-NuGet-...
You get one file defining the set of all packages used in your repo (or some subset of your repo, etc.) and Dependabot will update this file directly. Individual projects can choose to use a package but won't specify the version.
It requires that your projects are all in sync with package versions but (1) that sounds like what you want (2) it's usually the best thing.
Re:Bringing supply chain security features to the Go community
by plasma on Friday July 23, 2021 @08:17PM
(#27937240)
Thank you, looks like it’s still on preview but glad it’s being worked on.
Re:Bringing supply chain security features to the Go community
by greysteil on Friday July 23, 2021 @09:17AM
(#27930299)
Feature requests always welcome! I'll pass it on to the Dependabot team.
Re:Bringing supply chain security features to the Go community
by plasma on Friday July 23, 2021 @08:17PM
(#27937242)
Thank you
Re:Bringing supply chain security features to the Go community
by asciimike on Monday July 26, 2021 @01:05PM
(#27961965)
Let me know if https://github.com/github/roadmap/issues/148 is in the right spirit of what you're aiming for.
I think that what will get implemented will be a bit broader (covering version updates and security updates) and will allow for grouping by manifest, language, vulnerability, and potentially arbitrary labeling in the config file.
They thus also need to be updated together, but I wish one PR was opened to update the dependencies in all projects at once, instead of multiple PRs I to merge.
PS: I think you should highlight dependabot updates on the Security tab in GitHub repo, I thought it was on before (but was actually just the security notices) because dependabot itself is hidden away in Insights -> Dependency graph -> Dependabot which was a bit surprising.