an option to make MRs only for insecure deps about kira-dependencies HOT 9 OPEN

Yes, dependabot can do it: wemake-services/wemake-django-template#749

Here's my idea:

1. Use this method: https://github.com/dependabot/dependabot-core/blob/0549ebab2530b8287654da00ee382e72f4814c54/common/lib/dependabot/update_checkers/base.rb#L106
2. Only allow to create MRs for security updates: next unless checker.vulnerable?
3. Add an option DEPENDABOT_ONLY_SECURITY to make this configurable

Please, report if that works for you.

from kira-dependencies.

thanks for the tip.
unfortunately i have no idea of ruby, so i have to wait till someone makes a PR for it.
thanks.

from kira-dependencies.

@lorvent ok, I will do it in ~7 days.

from kira-dependencies.

Still no solution from my side. Sorry. Any ideas?

from kira-dependencies.

are we checking for deps using dependabot api

or directly checking with packagist.org and nmpjs.com ?

depending on that...we should findout may be.

from kira-dependencies.

Nope, just dependabot. Other options are out of scope of this project.

from kira-dependencies.

but i can't find any api link for dependabot.

can you please provide link?

from kira-dependencies.

I am not quite familiar with dependabot's code base and ruby (in fact that's my first ruby project and I still do even red a tutorial), but here you go a search reference: https://github.com/dependabot/dependabot-core/search?q=security&unscoped_q=security

from kira-dependencies.

hmm, lets hope someone else will make a PR for it, since they already have option to filter by security update or not.

from kira-dependencies.