News for hackers. Stuff that matters.

A comment on We use Dependabot to secure GitHub. Parent comment

Re:We use Dependabot to secure GitHub by asciimike on Wednesday May 25, 2022 @11:48PM (#31514252)
It shouldn't be automatically sending PRs for nix in the first place, right? Did you enable version updates? You can turn security updates off via https://docs.github.com/en/code-security/dependabot/dependab...

FWIW, I don't think security updates are turned on by default anymore, so new repos won't have this problem.

[ Parent | on HN ]
Re:We use Dependabot to secure GitHub by charcircuit on Thursday May 26, 2022 @12:05AM (#31514376)
>It shouldn't be automatically sending PRs for nix in the first place, right?

That's the problem it tried to update dependencies without touching nix which would messed up the build. It assumed it knew how to update it, but did it wrong.

[ Parent | on HN ]