- Tools such as dependabot and renovate can automate keeping dependencies up to date and opening PRs when security vulnerabilities are found. Still, some people seem to think they create noise. For now, I've left out automatic PRs and configured Slack notifications only for security risks rated Critical/High.
GitHub DocsDependabot 빠른 시작 가이드 - GitHub 문서Dependabot를 사용하여 취약한 종속성을 찾아 수정하십시오.GitHubGitHub - renovatebot/renovate: Home of the Renovate CLI: Cross-platform Dependency Automation by Mend.ioHome of the Renovate CLI: Cross-platform Dependency Automation by Mend.io - renovatebot/renovateGeekNewsDependabot을 끄자 | GeekNewsDependabot의 과도한 PR과 보안 경고가 만드는 노이즈를 지적하고, 실제 취약 코드 탐지와 주기적인 테스트를 대안으로 소개한 글.