⚠️ Go lib maintainer: GitHub's Dependabot is a 'noise machine'
｢ He argues that dependencies should be updated according to the project's development cycle, not whenever a new version of a package appears. Updating quickly also carries some risk if malicious code has been added to a package. ｣
https://www.theregister.com/2026/02/24/github_dependabot_noise_machine/
#Dependabot #vulnerability #github #opensource #cybersecurity
Source: billet de blog de Filippo Valsorda (filippo.io), publié le 20 février 2026. Contexte: retour d’expérience sur la gestion des vulnérabilités et des mises à jour de dépendances dans l’écosystème Go, avec un cas concret lié à un correctif cryptographique. — • L’auteur affirme que Dependabot génère une forte charge d’alertes inutiles (faux positifs, scores CVSS fantaisistes, « compatibilité » alarmiste), en particulier pour Go. Exemple à l’appui: après un correctif de sécurité publié pour filippo.io/edwards25519 (méthode Point.MultiScalarMult), Dependabot a ouvert des milliers de PRs vers des dépôts non affectés, y compris un faux avertissement pour le dépôt Wycheproof qui n’importait que le sous-paquet non concerné (filippo.io/edwards25519/field).
RE: https://mastodon.social/@h4ckernews/116105137504773423
I have a good story with #dependabot
I was working with a team that depended totally in #bots #llms #ai stack. So one day checking PRs I noticed a PR that overrides the dependencies of the framework that we used to build an API( #NestJS ) Yeah it was overriding the depends of Nestjs in our repo, I mean the dependencies of the dependencies
Why?
They told me that dependabot warnings about it.
I'm pretty sure the solution came from #chatgpt hahahahaahhaa
Wow, found a great use case for GitHub Copilot. It can help Dependabot finish update bumps that require code changes!
#github #copilot #dependabot #update #upgrade #ai #migration #pullrequest #automation #developer #code #agents
If you've ever wondered how to automate the upgrading of your JDK in Docker images, you might want to checkout my latest article.
#build
#cicd
#dependabot
#devops
#devsecops
#git
#github
#jdk #java #openjdk #temurin #eclipse
#scm #vcs #versioncontrol
#devlearning #softwaredevelopment #softwareengineering
Một plugin Prettier mới giúp tự động hóa việc giữ Dependabot config nhất quán trên đa repo GitHub. Được phát triển mở nguồn, công cụ này hỗ trợ lập trình viên tối ưu cấu hình và nâng cao hiệu suất DevOps. #mởnguồn #GitHub #Dependabot #DevTools #phầnMềmPhátTriển
https://www.reddit.com/r/opensource/comments/1qqm48a/i_wrote_this_prettier_plugin_to_keep_my/
If you'd like to find out how to set up GitHub Code Quality, you can check out my latest article on Medium.
#cicd
#codequality
#devops
#devsecops
#git
#github
#ghas
#codeql
#dependabot
#scm #vcs #versioncontrol
#sast
#devlearning #softwaredevelopment #softwareengineering
What if code quality wasn’t a tool you configured or had to maintain yourselves, but something GitHub just did for your repositories?
Read my latest article to find out all about this new feature and see how it can simplify the way you handle code quality scans.
#cicd #codequality #devops #devsecops #git #github #ghas #codeql #dependabot #scm #vcs #versioncontrol #opensource #devlearning #softwaredevelopment #softwareengineering
jbz
CyberVeille.ch
codeDude 
Hacker News
Toby Scott
André Polykanine
Martin Todorov
Reddit Tech VN Bot