Comment

Comment on How do you keep track of vulnerabilities?

That may work for a handful of projects. It’d be my full time job if I did it for everything I run. Also, I might simply suggest maintainers to adopt dependabot or an alternative before I spend time with manual changes. These things should be automated.

source

Sort:hotnew top

just_another_person@lemmy.world ⁨1⁩ ⁨month⁩ ago
Well a PR means an upstream fix for the project. If you want to scan all your local running things, by all means change whatever you want, but it will just be potentially wiped out by the tool you mentioned if running.

source
- eager_eagle@lemmy.world ⁨1⁩ ⁨month⁩ ago
  dependabot is a tool for repos, not to apply local changes
  
  source
  - just_another_person@lemmy.world ⁨1⁩ ⁨month⁩ ago
    I’m aware, but then you mentioned “manual changes”, which connotes “local changes”. Putting up a PR with changes isn’t considered a manual anything.
    
    source
    eager_eagle@lemmy.world ⁨1⁩ ⁨month⁩ ago
    
    “manual changes”, which connotes “local changes”
    
    It doesn’t. Manual as in a PR with upgrades that you’re suggesting yourself, as opposed to running dependabot.
    
    Putting up a PR with changes isn’t considered a manual anything.
    
    If I have to open a PR myself, that’s very much a manual change.
    
    source
    -> View More Comments