Stack Overflow
Stack Overflow

Questions tagged [dependabot]

Dependabot creates pull requests to keep your dependencies secure and up-to-date.

140 questions
1
vote
1 answer

How to configure dependabot to check multiple files?

The official recommendation from pip-tools for cross-compilation is: As the resulting requirements.txt can differ for each environment, users must execute pip-compile on each Python environment separately to generate a requirements.txt valid for…
dfrankow
  • 20,191
  • 41
  • 152
  • 214
1
vote
1 answer

Golang: what to do with google.golang.org/api obsolete dependencies on golang.org/x/net

Recently github.com Dependabot complained on some dependencies in my project which are vulnerable to DOS, have a "Broken or Risky Cryptographic Algorithm", and have a bug with "Uncontrolled Resource Consumption". Specifically, it is warning me about…
GRbit
  • 39
  • 7
1
vote
0 answers

Dependabot version fails due to outdated flutter version

I am working on an open-source flutter project it uses Github's dependabot to manage its dependency versions. But recently we upgraded our flutter to the latest version Flutter: 3.7.3 and after that all of the Dependabot PRs are failing…
Siddhesh B. Kukade
  • 167
  • 1
  • 9
1
vote
1 answer

Github Dependabot recommending Gemfile.lock PLATFORMS change from ruby to x86_64-linux. Nokogiri 1.13.1 -> 1.13.9

# Gemfile.lock - nokogiri (1.13.1) - mini_portile2 (~> 2.7.0) + nokogiri (1.13.9-x86_64-linux) ... PLATFORMS - ruby + x86_64-linux Hello! Dependabot is recommending a gem bump Nokogiri 1.13.1 -> 1.13.9 with the above diff. However I cannot…
i0x539
  • 4,763
  • 2
  • 20
  • 28
1
vote
0 answers

How to setup email alerts for only critical and high vulnerabilities in dependabot

I'm trying to setup dependabot on a collab github project, is there a way to send out alerts via email to all people on the project if there is a critical/high vulnerability alert?
Colin Jack
  • 19
  • 4
1
vote
1 answer

Dependabot not upgrading major versions of Maven SNAPSHOT dependencies

I've got dependabot setup, but even though a new minor version of a SNAPSHOT dependency is available, it's not being found. Take the following pom.xml:
Jakg
  • 922
  • 12
  • 39
1
vote
0 answers

How to fix transitive depedency generated by depedebot

We have enabled depedebot alert on our repository. But depedebot is not opening new PR for some of vulnebrites. For example : Below is one of alert I see ` The latest possible version that can be installed is 2.4.2 because of the following…
DevDenim007
  • 21
  • 3
1
vote
0 answers

Dependabot is NOT creating pull requests for parent pom version

Dependabot is NOT creating pull requests for parent pom version. We are using maven 3.X as package manager. Our project uses a parent pom version as below xxxxx-base-java-webapp …
SriA
  • 11
  • 3
1
vote
1 answer

Can dependabot suggest patches for direct dependency?

Currently, dependabot suggests only the vulnerable package patch version(fix) but If I need to upgrade only the direct dependency which consumes the fix. Is that possible with dependabot? Is this feature part of the backlog?
varunzxzx
  • 21
  • 8
1
vote
1 answer

Other ways of disabling default maven plugins as via phase none?

For some of my projects I don't need the default maven plugins, as for an example I use there no or other compilers. Disabling these plugins saves execution time and build output in this case. For the moment the only way to disable default maven…
Torsten Kleiber
  • 13
  • 4
1
vote
1 answer

Can't update private dependencies with dependabot

Context I have a library of private components stored in Bit.dev as my source of truth. To use them I must have a token and the registry information in my .npmrc file and with this token I can install all of my components anywhere I want. /**.npmrc…
Uriel Carneiro
  • 390
  • 3
  • 15
1
vote
1 answer

How can I get dependabot to ignore a docker minor version

I'm trying to stay one minor version behind the latest python version, and I was hoping to use dependabot to help with that. I'm using the python slim docker image as my base image, and based on that plus the dependabot docs I've added the following…
ChickenWing
  • 639
  • 9
  • 24
1
vote
1 answer

warning Lockfile has incorrect entry for "prismjs@1.24.0". Ignoring it

I have inherited an issue with prismjs whereby I have to remove/reinstall it every time I add/upgrade another package. I have a gocd pipeline validation that fails every time I try to use dependabot to address security vulnerabilities on my…
Grant Brennan
  • 27
  • 4
1
vote
1 answer

Dependabot Emails

I have been using dependabot for about a year and recently (past couple of months) I started getting some emails that never came before. There are two types of emails that I get and they seem to be somewhat regular: [GitHub] Your Dependabot alerts…
ssc327
  • 690
  • 1
  • 9
  • 19
1
vote
1 answer

how to find a username with the github api

I've made an application that creates pull requests to update the dependencies in all of my org's repos when the repo "Alpha" gets a new tag. The process is triggered by our CI flow on Alpha. Other engineers here would like to upgrade this…
Jed Godsey
  • 77
  • 2
  • 8
1 2 3
…
9 10