is #js the next #java applets, some may remember, there were so many viruses and hacks has been happening with #applets around 2000s at the end they drop the applets totally.
Now having #dependabot or #snyk is like just bringing a new security hole strangely opposite the intention.
Probably better to not upgrade if all versions are secure and stay there forever 😃
This filter documents the specific CWE family of resource exhaustion, uncontrolled iteration/recursion, and algorithmic-complexity weaknesses that are most likely to show up as dependency-driven de...
⚠️ Go lib maintainer: GitHub's Dependabot is a 'noise machine'
｢ He argues that dependencies should be updated according to the project's development cycle, not whenever a new version of a package appears. Updating quickly also carries some risk if malicious code has been added to a package. ｣
https://www.theregister.com/2026/02/24/github_dependabot_noise_machine/
#Dependabot #vulnerability #github #opensource #cybersecurity
Source: billet de blog de Filippo Valsorda (filippo.io), publié le 20 février 2026. Contexte: retour d’expérience sur la gestion des vulnérabilités et des mises à jour de dépendances dans l’écosystème Go, avec un cas concret lié à un correctif cryptographique. — • L’auteur affirme que Dependabot génère une forte charge d’alertes inutiles (faux positifs, scores CVSS fantaisistes, « compatibilité » alarmiste), en particulier pour Go. Exemple à l’appui: après un correctif de sécurité publié pour filippo.io/edwards25519 (méthode Point.MultiScalarMult), Dependabot a ouvert des milliers de PRs vers des dépôts non affectés, y compris un faux avertissement pour le dépôt Wycheproof qui n’importait que le sous-paquet non concerné (filippo.io/edwards25519/field).
RE: https://mastodon.social/@h4ckernews/116105137504773423
I have a good story with #dependabot
I was working with a team that depended totally in #bots #llms #ai stack. So one day checking PRs I noticed a PR that overrides the dependencies of the framework that we used to build an API( #NestJS ) Yeah it was overriding the depends of Nestjs in our repo, I mean the dependencies of the dependencies
Why?
They told me that dependabot warnings about it.
I'm pretty sure the solution came from #chatgpt hahahahaahhaa
Wow, found a great use case for GitHub Copilot. It can help Dependabot finish update bumps that require code changes!
#github #copilot #dependabot #update #upgrade #ai #migration #pullrequest #automation #developer #code #agents
If you've ever wondered how to automate the upgrading of your JDK in Docker images, you might want to checkout my latest article.
#build
#cicd
#dependabot
#devops
#devsecops
#git
#github
#jdk #java #openjdk #temurin #eclipse
#scm #vcs #versioncontrol
#devlearning #softwaredevelopment #softwareengineering
Một plugin Prettier mới giúp tự động hóa việc giữ Dependabot config nhất quán trên đa repo GitHub. Được phát triển mở nguồn, công cụ này hỗ trợ lập trình viên tối ưu cấu hình và nâng cao hiệu suất DevOps. #mởnguồn #GitHub #Dependabot #DevTools #phầnMềmPhátTriển
https://www.reddit.com/r/opensource/comments/1qqm48a/i_wrote_this_prettier_plugin_to_keep_my/
Özkan Pakdil
Pelle Wessman
jbz
CyberVeille.ch
codeDude 
Hacker News
Toby Scott
André Polykanine
Martin Todorov
Reddit Tech VN Bot