Conversation
Currently, renovate aggressively creates MRs in our repos, potentially pulling malicious dependencies from open source componentes before they may be spottet by the community (supply chain attacks). Furthermore, they are causing a lot of noise in our inboxes. This change introduces the following changes: * updates must be at least 2 weeks old * unless they fix a known vulnerability * pull requests are only opened once the change has passed the internal checks
aig-hannes
requested a review
from helmut-hoffer-von-ankershoffen
as a code owner
|
|
Nice, I didn't know this was an option. We discussed exactly this following the recent Trivy supply chain attack, and agreed to continue upgrading dependencies as quickly as possible, i.e. not use the This seems to give the best of both worlds, but I'd be curious to get @helmut-hoffer-von-ankershoffen's thoughts on this as he was advocating for immediate upgrades. |
Codecov Report✅ All modified and coverable lines are covered by tests. |
2 participants
Currently, renovate aggressively creates MRs in our repos, potentially pulling malicious dependencies from open source componentes before they may be spottet by the community (supply chain attacks). Furthermore, they are causing a lot of noise in our inboxes. This change introduces the following changes: