#dependabot — Public Fediverse posts

Dependabot version updates introduce default package cooldown

https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/

Comments: https://news.ycombinator.com/item?id=48913050

#HackerNews #Dependabot #version #updates #package #cooldown #software #development #GitHub #updates

"Dependabot no longer supports Python version 3.9, which has reached its end-of-life. If you continue to use Python 3.9, there’s a risk that Dependabot will not create pull requests to update dependencies. If this affects you, please update to a supported release of Python."

https://github.blog/changelog/2026-06-23-deprecation-of-python-3-9-for-dependabot/

#GitHub #Dependabot #Python #Python39 #EOL

[Перевод] Пакетным менеджерам пора ввести период охлаждения

Когда злоумышленник получает доступ к учетной записи мейнтейнера или захватывает заброшенный пакет, вредоносная версия может разойтись по тысячам проектов быстрее, чем ее успеют заметить. Один из способов снизить риск — ввести период охлаждения для зависимостей: не устанавливать новую версию пакета сразу после публикации, а ждать несколько дней, пока сообщество и вендоры безопасности успеют отреагировать. Публикуем перевод статьи Эндрю Несбитта о dependency cooldown и о том, как этот подход реализуют разные пакетные менеджеры и инструменты обновления зависимостей: npm, pnpm, Yarn, Bun, Deno, pip, uv, Poetry, Bundler, Cargo, Dependabot, Renovate и другие. Отдельно в материале рассматриваются различия между относительными интервалами и абсолютными датами, проблемы временных меток, исключения для обновлений безопасности и ограничения подхода в разных экосистемах.

https://habr.com/ru/companies/codescoring/articles/1044132/

#пакетные_менеджеры #зависимости #supply_chain_security #open_source #npm #PyPI #RubyGems #Dependabot #Renovate #dependency_cooldown

RE: https://mastodon.social/@hugovk/116399324188897230

Starting with v8.0.0, Astral switched setup-uv to immutable releases with no floating v8 tags. This is good for security.

But unfortunately #Dependabot and #Renovate couldn't upgrade from v7 to v8.0.0, and need a manual bump to get back on track. This is not so good for security.

I posted about this on the three social networks, someone tagged @www.jvt.me and soon after Renovate now supports this! 🎉

Here's his writeup into the world of #GitHubActions tags:
https://www.jvt.me/posts/2026/04/24/github-actions-tagging/

Good :blobnomcookie:

#opensource #pullrequest #GitHub #Dependabot

After my recent playing around with #Copilot, I thought I'd take a look at my Github billing report to see how much I'd used. I have, this month, used US$5.80 worth of Copilot ... and US$870 of actions.

Most of those computrons got burned when #Dependabot pushed branches and then when it created pull requests so that it could whine at me about point releases of stuff like #CrossPlatformActions (https://github.com/cross-platform-actions/action).

1/n

🚨 TeamPCP hijacks Bitwarden CLI in supply chain attack, abusing GitHub Dependabot to deploy Shai-Hulud malware and steal developer secrets, poison AI coding tools.

Read: https://hackread.com/teampcp-bitwarden-cli-dependabot-shai-hulud-malware/

#CyberSecurity #TeamPCP #Malware #Bitwarden #GitHub #Dependabot

Do you use astral-sh/setup-uv@v7 in #GitHubActions?

And it's not hash-pinned?

And you use #Dependabot or #Renovate?

The setup-uv project has switched to only Vx.y.z tags, no more Vx or Vx.y.

But Dependabot and Renovate won't upgrade from Vx to Vx.y.z, so you'll need to manually update to [email protected] to keep up with future updates.

"To increase security even more we will stop publishing minor tags. You won't be able to use v8 or v8.0 any longer."

https://github.com/astral-sh/setup-uv/issues/830
#Python #uv

Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:

https://daniakash.com/posts/simplest-supply-chain-defense/

#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios

is #js the next #java applets, some may remember, there were so many viruses and hacks has been happening with #applets around 2000s at the end they drop the applets totally.

Now having #dependabot or #snyk is like just bringing a new security hole strangely opposite the intention.

Probably better to not upgrade if all versions are secure and stay there forever 😃

https://www.youtube.com/watch?v=o7NYXvYohYk

⚠️ Go lib maintainer: GitHub's Dependabot is a 'noise machine'

｢ He argues that dependencies should be updated according to the project's development cycle, not whenever a new version of a package appears. Updating quickly also carries some risk if malicious code has been added to a package. ｣

https://www.theregister.com/2026/02/24/github_dependabot_noise_machine/

#Dependabot #vulnerability #github #opensource #cybersecurity

RE: https://mastodon.social/@h4ckernews/116105137504773423

I have a good story with #dependabot
I was working with a team that depended totally in #bots #llms #ai stack. So one day checking PRs I noticed a PR that overrides the dependencies of the framework that we used to build an API( #NestJS ) Yeah it was overriding the depends of Nestjs in our repo, I mean the dependencies of the dependencies

Why?

They told me that dependabot warnings about it.

I'm pretty sure the solution came from #chatgpt hahahahaahhaa

Turn Dependabot Off

https://words.filippo.io/dependabot/

#HackerNews #TurnDependabotOff #Dependabot #SoftwareDevelopment #GitHub #Automation #TechNews

Wow, found a great use case for GitHub Copilot. It can help Dependabot finish update bumps that require code changes!

#github #copilot #dependabot #update #upgrade #ai #migration #pullrequest #automation #developer #code #agents

🚀 Welcome to 2026, where we're still pretending to care about #open-source #dependency tracking! 🤖 #Dependabot isn't a smart bot, it's just a glorified Ruby script that merely mimics intelligence. 🙄 Let's all pretend we're surprised that the cool features are hidden behind a #paywall. 💸
https://nesbitt.io/2026/01/02/how-dependabot-actually-works.html #tracking #techhumor #softwaredevelopment #HackerNews #ngated

How Dependabot Actually Works

https://nesbitt.io/2026/01/02/how-dependabot-actually-works.html

#HackerNews #HowDependabotWorks #Dependabot #Explained #SoftwareDevelopment #Coding #BestPractices

Re earlier toot ... as soon as I'd finished dealing with #dependabot's PRs, I wanted to use the script to view other peoples' PRs against my code (there are only two that I've not dealt with because I'm a good boy, although one has been festering for 7 years because I'm a bad boy), and then to see all my PRs against other peoples' code that are still open. And so the script got just a teensy bit bigger.

https://github.com/DrHyde/shellscripts/blob/9c4527e85dafda60667279f69303ef3b3e775e52/gh-open-dependabot-prs

#ShellScript

RE: https://fosstodon.org/@DrHyde/115774852044573240

Arising from this ... overnight, #dependabot shat approximately 15,000 pull requests at me, all of which I needed to look at. I could have written a small script to parse them all out of my mailbox, but a script that uses #GitHub's CLI tool and API is always gonna be more reliable. https://github.com/DrHyde/shellscripts/blob/1f29bf86aa143703e7f1f89d1c58215c68d57e3d/gh-open-dependabot-prs

Version 2 might save me having to look at them, by only showing me PRs which touch unexpected files or have test failures, and just auto-merge the rest. Need to look at the API in more depth.

#Dependabot alerted me to a high-severity defect in a transient dependency (the dependency is from Stripe!). The same day a user reported a defect in the system that's apparently been there for quite some time. Both are now fixed in production.

So that's how my #NYE is going.

FYI: Log4Shell: 4 Years Later, Are You Still Vulnerable? #shorts: When the Log4Shell attack hit, teams scrambled. Older Log4j versions needed manual workarounds. What if a bot could try upgrades and run tests? Teams with test suites stay up-to-date, owning their security. #Log4Shell #security #cybersecurity #Dependabot #vulnerability https://www.youtube.com/shorts/IJs6EZgoogk

Automating Drupal release notes in Dependabot PRs #drupal #dependabot #github https://mglaman.dev/blog/automating-drupal-release-notes-dependabot-prs?utm_campaign=blog&utm_source=fediverse&utm_medium=social&utm_content=toot

Its that time of the month again.

*starts merging #dependabot updates*

#github

🥱 Javascript-moeheid. Kenden jullie die term al? Dat is het gevoel dat optreedt nadat je voor de derde keer in de maand NPM-packages hebt moeten updaten in in hetzelfde project, omdat Dependabot weer met nieuwe alerts kwam.

Onze collega @tomootes schreef er een blog over:

https://developer.overheid.nl/blog/2025/11/26/zo-min-mogelijk-npm-dependencies

#javascriptfatigue #js #dependabot

#AI #dependabot doing just fine…

> build(deps): Bump spring-boot.version from 4.0.0 to 4.0.0

Thing is too stupid to realise I have—on purpose—two different Spring Boot versions in that project. One can't be bumped as its dependencies did not catch up the release train.