Dependabot alerts paused for malware advisories | Hacker News Reader

Dependabot alerts paused for malware advisories

github.blog

47 pointscapableweb19 comments

Honestly dependabot is so bad I'm surprised anything other than the smallest projects use it, broken upgrades, lack of configurability, no multi-update PRs etc... and it only runs on GitHub.

I now recommend Renovate to clients which is also free, but a lot smarter.

https://github.com/renovatebot/renovate

https://renovatebot.com/

Even within github, everyone ignores dependabot updates. Until the security team comes prodding about serious vulnerabilities, no one bats an eye.

IME Dependabot is, at best, annoying.

Unless it opens a full-fledged PR with the fixes and a good description of WHY, I don't want it.

That sounds like exactly what it does? How would you describe it?

Usually opens PRs too minor to be worthwhile.

They update a single dependency. Pretty much what you'd want I think. Takes <1 minute to skim over the update and merge it. Do you prefer to let your dependency updates build up and update them one a sprint/quarter? I've done that in the past and so far using dependabot (use it at work) seems easier.

I don't like being interrupted randomly by a bot just for a dependency bump. It feels like I'm working for the computer instead of the other way around.

To be clear, I'm not arguing to not update vulnerable dependencies, though often enough my project doesn't actually use the vulnerable part of said dependency, effectively making the whole exercise somewhat pointless, akin to virtue signaling for dependencies. Sounds dumb, right?

For work projects, I appreciate it. For my open source experiments, not so much.

If there was a way to let the bot do everything from beginning to end, merging and possibly breaking everything without manual intervention, that could be exciting! (Probably in a bad way? Milage will surely vary!)

> Sounds dumb, right?

Realistically, no, I don't think so.

You're making a choice between updating everything as soon as possible, or batching everything until it's actually needed. Both valid approaches, but I prefer the first. It saves you when one day you discover that you really need to do some critical update... but now it also depends on updates to foo, bar and baz, and changes to your code because some API got deprecated and you need to figure out how they impacts your external interface. I'd rather deal with 100 trivial/pointless updates trickling in daily instead of one of those situations.

Supply chain attacks are already scary enough, but with package updates being auto merged into tens of thousands of GitHub repositories? Oof!

I guess it depends on the expectations, but I want dependabot to open a PR for every single minor update. The minor ones take a second to see and click merge if your tests are passing. Actually, "too minor" does not exist for me.

+1 for Renovate - it has support for more languages/ecosystems, it is more configurable and it is fully open source.

Anyway, this kind of attack would also work with Renovate but you could create a good company-wide config to prevent this.

Did they ever fix the problems with Dependabot and forks of repos using it? That's what turned us off from using it.

I did not realize substitution attacks were so common. Disabling dependabot alerts seems to be sidestepping a major security problem, hopefully Github (and NPM) come up with a more long term solution

What a mess. I don’t understand how they didn’t see this coming.

When this functionality was published, about 0% of comments mentioned this as a possibility

I mean to ask how the GitHub product managers and engineers didn’t catch it. I wouldn’t expect hacker news commenters to pick up on a design defect in the few minutes they spent thinking about this, but in retrospect it seems like something that should have come up in planning or testing.

Thanks for all the #%^*ing branches, Dependabot. I wish you were opt in rather than opt out.

Dependabot is opt in

Not for forks https://github.com/dependabot/dependabot-core/issues/2804

Reply on news.ycombinator.com