DoDiODev opened a new issue, #9279: URL: https://github.com/apache/devlake/issues/9279
## Search before asking - [x] I had searched in the [issues](https://github.com/apache/devlake/issues?q=is%3Aissue) and found no similar feature requirement. ## Use case `.github/dependabot.yml` (since #9089) only configures **version updates**. For Go, those only cover direct dependencies; `// indirect` modules are never bumped. Security fixes in indirect modules therefore go unnoticed upstream. Example: `github.com/go-jose/go-jose/v4` (indirect, via `coreos/go-oidc/v3` → `helpers/oidchelper`) is affected by GHSA-mgcc-cww5-fp2q (CVE-2026-116587, high), published 2026-10-14. The weekly `go-minor-patch` group (#9268) does not include it. My fork has Dependabot **security updates** enabled and got a PR for it on 2026-10-28; `apache/devlake` did not. I opened #9278 for this one manually. ## Description Would the maintainers consider enabling Dependabot alerts and security updates for this repository? For ASF repositories this is controlled by `.asf.yaml`: ```yaml github: dependabot_alerts: true dependabot_updates: true ``` Security-update PRs follow the existing `commit-message` prefix (`build(deps)`) and the `ignore` rules in `.github/dependabot.yml`. They only appear when an advisory affects a dependency, so the additional PR volume should be low. I can open a PR for the `.asf.yaml` change if you would like that. Since it changes repository settings, I would rather ask first. ## Related issues #9089 ## Are you willing to submit a PR? - [x] Yes I am willing to submit a PR! ## Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
