dependabot/dependabot-core
View on GitHub ↗ ★ 5,831 Ruby
🤖 Dependabot's core logic for creating update PRs.
23 mentions on Hacker News by 20 people: 2 stories, 21 comments · first 2017-09-09 · latest 2026-01-08
20082026
-
…Specifically, the uv.lock file is not being updated when security alerts are triggered. — https://github.com/dependabot/dependabot-core/issues/10478#i...
comment by JimDabell · 2026-01-08 · in How dependabot works -
▲ 2
Dependabot failed to support uv for over a yearstory by kim-gustyr · 2025-08-19 · 0 comments
-
Seems like this was requested in 2021 and is currently in beta testing for select ecosystems only: https://github.com/dependabot/dependabot-core/issues/3651
comment by morningsam · 2025-06-08 -
…conda-lock.yaml, pixi.lock" https://github.com/regro/cf-scripts/issues/3920#issuecomment... https://github.com/dependabot/dependabot-core/issues/2227#is... incl. links to the source of dependabot
comment by westurner · 2025-03-31 · in Python lock files have officially been standardized -
GitHub is looking to add this feature to dependabot: https://github.com/dependabot/dependabot-core/issues/3651
comment by esafak · 2025-02-19 · in Debugging Hetzner: Uncovering failures with powerstat, sensors, and dmidecode -
Oh yes, https://github.com/dependabot/dependabot-core/issues/3253 . I wouldn't go so far as saying it was locked because it was too uncivil, mostly just because "additional commentary wasn't adding value" ;) Your read on the situation is…
comment by asciimike · 2024-04-12 · in Why I recommend Renovate over any other dependency update tools -
…I dismiss another alert from it, I can't help but wonder if there's a better option out there. [0] https://github.com/dependabot/dependabot-core/issues/2521
comment by Etheryte · 2024-03-13 · in Storybook 8 -
…aware that dependabot-core, which dependabot-gitlab wraps, is not technically Open Source at all: https://github.com/dependabot/dependabot-core/blob/main/LICE... Wrapping a non-open source project in another project which claims to be MIT…
comment by rarkins · 2022-10-02 · in Private profiles are now generally available on GitHub -
Not for forks https://github.com/dependabot/dependabot-core/issues/2804
comment by progval · 2022-07-03 · in Dependabot alerts paused for malware advisories -
Waiting for Yarn v2/v3 support in Dependabot has been a saga. https://github.com/dependabot/dependabot-core/issues/1297
comment by amacneil · 2022-05-26 · in We use Dependabot to secure GitHub -
> This plus the fact that Dependabot is not able to update Docker Compose files at this time. https://github.com/dependabot/dependabot-core/issues/390 upvote and/or implement it as a fork and run it in an Action. > The other problem that I…
comment by asciimike · 2022-05-26 · in We use Dependabot to secure GitHub -
…asks about Setuptools support, and has been pretty dormant. I thought setup.cfg was supported after https://github.com/dependabot/dependabot-core/pull/3423 , but another project of mine ( https://github.com/stanford-rc/mais-apis-python/netw…
comment by CaliforniaKarl · 2022-05-25 · in We use Dependabot to secure GitHub -
agreed, FYI dependabot is open source for non-commercial use and you can run it locally https://github.com/dependabot/dependabot-core/blob/main/LICE...
comment by dustinchilson · 2022-02-10 · in Show HN: Updatecli – What if Dependabot and Ansible had a child? -
…it yourself, these are helpful :) https://docs.github.com/en/actions/creating-actions/about-cu... https://github.com/dependabot/dependabot-core/issues/2835 https://github.com/zgosalvez/github-actions-ensure-sha-pinne...…
comment by patcon · 2022-01-25 · in GitHub Actions by Example -
…[1] https://github.com/dependabot/feedback/issues/954#issuecomme... and the original issue: https://github.com/dependabot/dependabot-core/issues/1973 And why it doesn't fly: https://github.com/dependabot/dependabot-core/issues/1973#is...
comment by dmitriid · 2021-07-23 · in Bringing supply chain security features to the Go community -
…Maven version comparison rules on it). I'll try and get a PR in today and will tag you. Update: https://github.com/dependabot/dependabot-core/pull/4077
comment by greysteil · 2021-07-23 · in Bringing supply chain security features to the Go community -
I also get a lot of spam from dependabot because of prereleases, I wish they would fix this bug: https://github.com/dependabot/dependabot-core/issues/2547 As others have pointed out, you can opt for daily / weekly or monthly updates, I'll…
comment by hiq · 2021-07-23 · in Bringing supply chain security features to the Go community -
…migration of Dependabot (for example, take a look at this issue and especially, how it was handled: https://github.com/dependabot/dependabot-core/issues/3253 )
comment by Tainnor · 2021-06-02 · in GitHub was having issues -
▲ 1
GitHub Dependabot soon drops support for auto-merging upgrade PRsstory by honzajavorek · 2021-04-30 · 0 comments
-
…By reading all the code? [1]: https://github.com/diem/diem/tree/master/consensus#how-is-th... [2]: https://github.com/dependabot/dependabot-core#architecture [3]: https://github.com/dependabot/dependabot-core/blob/main/comm...
comment by baby · 2021-02-06 · in Architecture.md -
…open source isn't a material consideration for me. (The license text I was referring to is here: https://github.com/dependabot/dependabot-core#license . I could hire a lawyer and put a proper, proprietary license on the repo but I'm…
comment by greysteil · 2018-06-10 · in On paying for software -
…if it does. Edit: ooh, I see its oss and this search indicates Pipfile support is likely: https://github.com/dependabot/dependabot-core/search?utf8=%E...
comment by dschep · 2017-12-18 · in Show HN: Dependabot – Automated Dependency Update PRs for Ruby, JS, Python and PHP -
…of the project, which is all the logic for actually doing the dependency updates, is open source at https://github.com/dependabot/dependabot-core
comment by greysteil · 2017-09-09 · in Show HN: Dependabot – automated dependency updates for Ruby and JavaScript (Yarn)