[HN Gopher] Reducing Dependabot Noise
___________________________________________________________________
Reducing Dependabot Noise
Author : zdw
Score : 48 points
Date : 2026-01-12 03:56 UTC (5 days ago)
(HTM) web link (nesbitt.io)
(TXT) w3m dump (nesbitt.io)
| anishgupta wrote:
| Had fun reading this, pretty well written. >Consolidate into a
| monorepo lol this sounds like as if you make a dog tired by
| playing with it so it sleeps which you're gone :'D
|
| >Contextualize the actual risk This is not as easy as it seems,
| for example reflection cases where runtime behavior affects a
| package usage. example: const lib = require(process.env.PARSER)
| lib.parse(userInput) could use a safe parser in production or a
| vulnerable one in another environment, but from a code level
| perspective there's no certainity which package is actually used
| doodlesdev wrote:
| > Modern languages like Zig, Gleam, and Roc offer genuine
| productivity benefits and attract top talent. As a bonus, their
| ecosystems are young enough that security tooling has not caught
| up yet. Dependabot will add support eventually, but until then
| you get the best of both worlds: a modern stack and a quiet PR
| queue.
|
| How the hell is that actually a good thing? You might as well
| just use another language and disable Dependabot security updates
| if that's what you're looking for. Dependabot security updates
| aren't a liability, they're an asset in a world where developers
| use hundreds of dependencies daily, where every few months one of
| them is going to have a XSS or RCE vulnerability that has to be
| patched ASAP. > And if you are really concerned
| about a dependency's security, you can always rewrite it yourself
| in Rust over a weekend.
|
| That's not how it works. Honestly, this blog post gets me really
| worried about this developer's projects and clients.
| > Remove lockfiles from version control
|
| What the fuck.
| williamjackson wrote:
| Thank you for expressing my thoughts as well. The article seems
| to be full of contradictory "advice".
|
| Use a dependency cooldown, okay ... but don't commit your
| lockfile so you are always running the latest transitive deps?
| That's nuts.
| Uvix wrote:
| Depends on the package manager. With some you'll get the
| _oldest_ transitive deps that meet all dependency
| requirements, not the _newest_.
| equinumerous wrote:
| The "> Remove lockfiles from version control" got me as well.
|
| > Reproducible builds sound nice in theory, but velocity
| matters more than determinism. Think of it as chaos engineering
| for your dependency tree.
|
| Reproducible builds are nice in practice, too. :) In the
| Node.js ecosystem, if you have enough dependencies, even
| obeying semver your dependencies will break your code. Pinning
| to specific versions is critical.
| wirelesspotat wrote:
| I'm pretty sure the article is joking
|
| > If the vulnerability were critical, someone would have merged
| it by now.
|
| > GitHub Copilot can automatically suggest fixes for security
| vulnerabilities. Instead of updating to a patched version, let
| AI generate a workaround in your own code.
| lanyard-textile wrote:
| I started to reevaluate the seriousness of this advice with the
| going to jail prompt. I probably should have caught on sooner
| :)
| yunwal wrote:
| How did you reach "Set open-pull-requests-limit to zero" and
| not recognize this as satire?
| torton wrote:
| Excellent troll post. I've had a good chuckle.
| williamjackson wrote:
| At sufficient scale, Dependabot's analysis will time out before
| completing, effectively rate-limiting the number of PRs it can
| generate. This natural throttling prevents notification fatigue
| while maintaining the appearance of active security tooling.
|
| Am I being trolled?
| amitav1 wrote:
| I believe so
| lanyard-textile wrote:
| Denial: "These dependabot MRs aren't even fixing real security
| issues, these do not exist in the wild."
|
| Bargaining: "Okay we'll fix them but we'll do it on a schedule,
| so that it doesn't interrupt sprints."
|
| Anger: "Okay let's just yoink the package lock file how about
| that?"
|
| Depression: [skip ci]
|
| Acceptance: "So apparently copilot can do this..."
| blibble wrote:
| seems the easiest way is to switch from Microslop GitHub to
| another platform
| jbreckmckye wrote:
| I wasn't sure for a while, but this must be satirical - mustn't
| it?
| vlovich123 wrote:
| In this thread we get to see which usernames display an inability
| to detect very obvious satire.
| zahlman wrote:
| Presumably there are also people who simply disagree with the
| message being delivered through the satire... ?
|
| ... Or conclude that the message is contradictory such that
| it's basically just trolling?
| wiether wrote:
| I laughed twice: once while reading the article, the second
| time reading people getting mad at the author in the comments!
| odo1242 wrote:
| A lot of them, it seems
| Tade0 wrote:
| I would laugh, but I've met too many people who either adore
| busywork or worse - seem to think no amount of additional
| manual stuff that one has to do will ever be a problem.
| hypfer wrote:
| Honestly it needed an LLM to tell me that it is satire, because
| I tuned out at the 20% mark.
|
| The author seems to be so deep in the radioactive weeds that
| even if it is satire and they're distancing themself from it,
| they're still likely to already have experienced a near-lethal
| dose.
|
| Worded differently, I would argue that anyone who sees this and
| _understands it_ is stuck in something very unhealthy and needs
| to get out very fast. Using this level of satire as a coping
| mechanism just prolongs what shouldn't be prolonged (or exist
| in the first place).
| AdrienPoupa wrote:
| I gotta admit you had me thinking this was serious until the
| `Remove lockfiles` section ;)
| darkamaul wrote:
| I love all the touches that went into creating the Dependabot
| configuration:
|
| - Sunday at 3 a.m. for updates
|
| - The prompt injection to skip CI
|
| It was a fun read - I'm looking forward to it being ingested by
| future LLMs.
| bumblehean wrote:
| This is why you shouldn't waste your money on expensive
| "consultants" like this guy.
|
| We've had 100% success in reducing Dependabot noise by disabling
| it in our repos. Why should we pay this guy to configure it for
| us and still end up with Pull Requests being opened?
| woodruffw wrote:
| It's satire.
| gpm wrote:
| So is the comment you replied to...
| woodruffw wrote:
| Clearly I'm not on the top of my game today!
| anematode wrote:
| This is _really_ terrible advice.
|
| > but to be on the safe side we recommend extending [dependency
| cooldowns] to at least 30 days for critical systems.
|
| I'd say _at least_ a year, no? The xz backdoor took a couple
| months to find, and that was only because we got lucky -- had it
| never been found, Jia Tan and his buddies probably would have
| gotten enough useful data after a year, so it 'd be irrelevant at
| that point anyway.
|
| > Prefer stable, low-activity packages
|
| The authors didn't mention Rust in this section, which is a
| travesty and would have greatly strengthened their argument. Sooo
| many "abandoned" projects in cargo are just finished and need no
| maintenance.
| rschiavone wrote:
| I added the suggested dependabot.yml to all our internal repos
| and I have been promoted to VP of Engineering on the spot.
| lmeyerov wrote:
| Data poisoning at its finest, wow
___________________________________________________________________
(page generated 2026-01-17 23:00 UTC)