Post #375647
2026-02-20 19:56 UTC
Dependabot security alerts have terrible signal-to-noise ratio, especially for Go vulnerabilities. That hurts security!
Just turn it off and set up a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
Less work, less risk, better results!
https://words.filippo.io/dependabot/?source=Mastodon
Replies (4)
-
@jamesog@mastodon.social 2026-02-20 20:09
@filippo And they claimed they fixed it <.< https://github.blog/changelog/2025-12-09-dependabot-dgs-for-go/
-
@tmaher@infosec.exchange 2026-02-20 21:30
@filippo this is super cool. Do you know of any similar approaches in other languages?
-
@YvanDaSilva@hachyderm.io 2026-02-21 23:42
@filippo yep, been doing that on my repos and at work too. Dependabot is pure noise.
-
@timbray@cosocial.ca 2026-02-22 22:00
@filippo I loathe Dependabot, even for zero-dependency projects, because every time I approve one of those rather-opaque PRs, I think “The bad guys only have to compromise Dependabot or one of the adjacent CI-toolchain packages and they own the world and probably do it in a way that I’m not smart enough to notice until too late.” Am I being unreasonable?