Paperless: Use dependabot to keep up with recent and secure dependencies

[tooomm]

It's a nice service, free of charge for open source projects.
Supporting python and javascript: https://dependabot.com/#languages

[danielquinn]

Dependabot looks pretty slick, but I won't grant them write access to code in this repo, especially when the service claims that all it needs is to open issues & pull requests.

There are a number of services out there that claim to do this sort of thing, but I haven't yet found a single one that will let me use their services without giving them the ability to change the code that runs on the machines of Paperless users, so until I can find one, I'll have to do this the old fashioned way :-)

[tooomm]

Ok, I understand.

I might be wrong, but isn't that needed to create a new branch in the repo to open a pull request from there against master?
At least that's how dependabot does it. They don't fork each and every repo.

Maybe instead, there is some service that monitors your dependencies and lets you know or displays what's out of date and you can more easily track and update then manually?
Like david-dm for node.js, for example: https://david-dm.org/request/request

[danielquinn]

A passive monitor sounds great, but that david-dm is even more invasive than dependabot :-(

[tooomm]

Well, no idea what they really need to work the way they work.

But did you read their side?

You don't need to grant david-dm any access unlike you want to mange it over their page, which doesn't give you any advantage or even had any effect as far as I could tell.

Simply use a link like

• https://david-dm.org/org/repo.svg
  for the badge, or
• https://david-dm.org/org/repo
  for the status page

Maybe it's not as up to date then, but it works without installing any app or granting oauth access because it only checks the package.json file in your repo.

[Strubbl]

not very expressive so far

will it someday be green or red? or do one have to register to get it from pending to a different status?

[danielquinn]

My guess is that at the very least, they need to run whatever checks are required, and that may only happen once a day, so let's give it a day or so and if the badge changes, we can add it to the README.

[tooomm]

For the repo I tested it with, it changed within ~1 hour.

You realized that it's for Node.js only (with a package.json file) and I used it as an example?
That's why you also only get Internal Server Error for the status page.

If you try it for https://github.com/thomasbrueggemann/paperless-desktop, it'll work:
https://david-dm.org/thomasbrueggemann/paperless-desktop
You get the same pending badge (because it never got checked):
But it will update after a while!

Actually I should let him know about the security vulnerabilities, will do so later today. :D

[thomasbrueggemann]

Thanks for letting me know, @tooomm . In case of paperless-desktop the detected security vulnerabilities are neglectable, since they concern server-side implementations of Node.js and are rather not targeted towards Electron based desktop applications. But more details in the linked issue above :-)