Re:Best practices to keep your projects secure on GitHub
by prepend on Thursday April 28, 2022 @02:10PM
(#31196035)
It’s also easy to stick with #1 and leave pinned to specific versions and only update for security reasons.
This used to be a pain so automatically updating was an easy way to stay up to date and reduce risk. But now with dependabot, I can pin to specific versions and leave it there forever, until dependabot detects the vulnerability and submits a PR.
This used to be a pain so automatically updating was an easy way to stay up to date and reduce risk. But now with dependabot, I can pin to specific versions and leave it there forever, until dependabot detects the vulnerability and submits a PR.