Title: I like the idea of Dependabot. A to that actively tracks down dependency updates can be useful. Where I work, we have a daily CI job that creates a PR for each new dependency and runs a build in both our UI (JavaScript) and API (Python) projects. If the build passes, &quot;Happy Days&quot;, we can merge the PR, and the app is all the more secure and effective for it.<p>What I&#x27;ve noticed in practice however, is that occasionally, this process will allow an upgrade to a dependency that will pass the automated build and test step, but introduce the wildest runtime error into the application. Usually at the time when we aim to deliver something.<p>Dependency &#x27;spam&#x27; is also a very real issue - https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=27929596 - the daily deluge of often insignificant updates is a trudge to deal with, especially when coupled with the risk of these sly runtime errors.<p>Dependabot is a great idea, but no-one appears to have anything bad, or practical, to say against it. But it does clearly have flaws.<p>I don&#x27;t think I&#x27;d want to switch the bot off, but I would be interested in hearing how other people get on with the tool.<p>Thanks. :]
Upvote: