Hacker News Reader

I believe Dependabot quantifies this to some extent with a "Compatibility score": https://dependabot.com/#how-it-works

But it can only measure what people have test coverage for, presumably.

I did see that, but it's pretty opaque (some percentage). And when I click through the badge, it takes me to GitHub's help page [0]. What would be helpful is to link to other public PRs so you might be able to find out how other people solved the issues. Is there any way to see historic compatibility scores to evaluate if it's worth to drop a certain dependency?

Edit: For normal dependency updates, compatibility probably more useful. For security fixes, what choice to you have other than to apply it, or spend more time investigating and trying to come up with your own mitigation?

[0] https://help.github.com/articles/configuring-automated-secur...

Reply on news.ycombinator.com