mirror of
https://github.com/plankanban/planka.git
synced 2026-02-25 03:14:50 +03:00
Automate dependency updates via Dependabot #486
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mxr576 on GitHub (Apr 21, 2024).
With the growing number of consumers relying on the Planka project, it's essential to maintain its security and reliability. While leveraging GitHub's built-in package audit feature is a good start, configuring automated package updates through Dependabot GitHub Actions (GHA) can further enhance the project's robustness.
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
@meltyshev commented on GitHub (Apr 22, 2024):
Hi! Thank you for your comment. We get Dependabot alerts and try to monitor dependencies, but at the same time, we can't fully automate this process, because every time we also need to check what the update includes (it might have new vulnerabilities, backdoors, etc.), so we update them manually. There was also an issue with Dependabot where some PRs had a completely different version of a dependency that could cause the app to crash, but this may have been fixed long ago and we need to try again.
@meltyshev commented on GitHub (Apr 23, 2024):
We've updated all the packages and re-enabled Dependabot.
@mxr576 commented on GitHub (Apr 24, 2024):
Awesome 💪
Thanks!