Conversation

Notices

1. Embed this notice
   Alex Gleason (alex@gleasonator.com)'s status on Thursday, 12-Jan-2023 00:35:34 JST Alex Gleason

   I set up a dependency scanner in Soapbox two weeks ago. It detected 20 vulnerabilities in our build process (that would be CI runners and development machines, none affecting users or the build itself). Squashed them all and now there’s zero.

   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Thursday, 12-Jan-2023 03:56:57 JST Alex Gleason

     in reply to

     • Tassoman

     @tassoman We use Renovate on GitLab. It runs a CI on a schedule: https://gitlab.com/soapbox-pub/ci/renovate

     This repo doesn’t store code, and exists only for the purpose of running the CI. Did you know you can use GitLab to manage your cron jobs? Pretty awesome.

   • Embed this notice
     Tassoman (tassoman@orwell.fun)'s status on Thursday, 12-Jan-2023 03:56:59 JST Tassoman

     in reply to
     Does GitLab have something like the «dependabot»? Did you this?
     Maybe an Dependalexbot?