How would that solve the problem though? You're still bringing compromises in, just with a delay. And the fixes will come in after the compromise, in accordance with the delay policy.
To make matters worse, you'd lose getting alerts on vulnerabilities. Dependabot won't send them, and neither will Renovate last time I checked.
- raises PRs for security fixes immediately, regardless of cooldown configs
- flags the PRs as security fixes
- does the above when actions are pinned by commit SHA
? If so, mind sharing some documentation and examples please? I don't mind being proven wrong, but I genuinely couldn't find anything that demonstrates this happens. Dependabot docs actually point to the contrary (see my blog posts).
Comments
Valid point. We have minimum age requirements set on some rules to avoid absorbing every latest change instantly.
How would that solve the problem though? You're still bringing compromises in, just with a delay. And the fixes will come in after the compromise, in accordance with the delay policy.
To make matters worse, you'd lose getting alerts on vulnerabilities. Dependabot won't send them, and neither will Renovate last time I checked.
Both Renovate and Dependabot will raise PRs for a security fix, regardless of minimumReleaseAge/cooldown config
Are you saying that Dependabot/Renovate...
- raises PRs for security fixes immediately, regardless of cooldown configs
- flags the PRs as security fixes
- does the above when actions are pinned by commit SHA
? If so, mind sharing some documentation and examples please? I don't mind being proven wrong, but I genuinely couldn't find anything that demonstrates this happens. Dependabot docs actually point to the contrary (see my blog posts).