-
-
Notifications
You must be signed in to change notification settings - Fork 0
Research - Dependabot, Finding a process to handle SCA #75
Copy link
Copy link
Open
Labels
documentationImprovements or additions to documentationImprovements or additions to documentationquestionFurther information is requestedFurther information is requestedresearchResearch for open questions, potential new features, and related discussions.Research for open questions, potential new features, and related discussions.
Description
Metadata
Metadata
Assignees
Labels
documentationImprovements or additions to documentationImprovements or additions to documentationquestionFurther information is requestedFurther information is requestedresearchResearch for open questions, potential new features, and related discussions.Research for open questions, potential new features, and related discussions.
SCA needs a process, not a simple tooling decision. The two main choices are Dependabot and Renovate.
Question: Should we move away from Dependabot?
Dependabot is noisy. Version updates are an anti-pattern. There is a need for more control over when and how Dependabot runs.