Best practices to keep your projects secure on GitHub

Re:Best practices to keep your projects secure on GitHub by mcraiha on Thursday April 28, 2022 @12:14PM (#31194371)

Article is all about dependencies. And it only mentions JavaScript. So maybe a better topic would be: "How to use GitHub dependency tool to secure your Javascript project"

[ Parent | on HN ]

Re:Best practices to keep your projects secure on GitHub by cebert on Thursday April 28, 2022 @12:55PM (#31194925)

I’ve noticed Dependabot isn’t always even the greatest for JS projects. There are popular front-end frameworks such as Angular or React. When it makes PRs for currency updates, it seems unaware that it should update all packages for a particular framework or update @types imports when it updates a package import.

[ Parent | on HN ]

Re:Best practices to keep your projects secure on GitHub by jhutchings0 on Friday April 29, 2022 @06:00PM (#31211072)

Hi from the Dependabot team! We're working on a fix for the Typescript @types problem that should be available very soon.

[ Parent | on HN ]

Re:Best practices to keep your projects secure on GitHub by Dragory on Thursday April 28, 2022 @12:23PM (#31194504)

It looks like they support other package ecosystems as well: https://docs.github.com/en/code-security/supply-chain-securi...

That said, the article does indeed seem to focus entirely on dependencies.

[ Parent | on HN ]