Turn Dependabot off(words.filippo.io)
606 points by todsacerdoti | 178 comments
Filippo Valsorda's blog post arguing that Dependabot is a noise machine and should be turned off, especially for security alerts in the Go ecosystem.
#dependabot on Hacker News
2 stories tagged dependabot, newest first.
We should all be using dependency cooldowns(blog.yossarian.net)
460 points by todsacerdoti | 259 comments
Blog post arguing that dependency cooldowns, via tools like Dependabot and Renovate, are a cheap, effective way to mitigate most open source supply chain attacks.