HN Explorer

Ask HN: How do small teams pragmatically manage Dependabot fatigue?

1 points by maxk85 ↗ HN
Amount of CVEs nowadays is kind of madness and I'm wondering how you're all dealing with the updates? I know larger organizations are more structured in this regard - there's private dependencies registry with some kind of vetting process, so not everyone has to decide what version to take.

But what about smaller projects without private registry platform solution? How you go about updating your packages? Especially for projects without high frequency changes.

I'm genuinely curious. Is it just `npm update` or similar locally? or in the controlled environment (Github Actions)? Do you ask LLM to do the job for you? How you go about extending semver constraints?

From my personal experience, this takes an awful lot of time and attention:

1. I need to review all the CVEs (reported from the Dependabot for example)

2. Then collect all the patched versions and pray there's a patch for my major

3. If no, then go check changelog of everything I have to update.

4. Then I need to figure out what exactly I need to update in my project

5. Sometimes the change is awkwardly large or LLM is not enough to migrate (this is especially sensitive for the UI-related stuff)

6. Then proceed with updates. Sometimes, it would require to update other packages or override version

I'm curious how it works for others, especially for smaller companies

- Do you have dependencies update cadence?

- Are you leveraging any additional tools to make it easier?

- Do you have a process around what alerts to ignore?

5 comments

[ 3.7 ms ] story [ 10.6 ms ] thread
giantg2
Dependabot isn't very useful in my view. I would rather have static and build scans (Wiz, Checkmark, etc) telling me about vulnerabilities and blocking critical and highs. Then we can analyze if the vulnerability is exploitable in our system or not. If it is, we can upgrade and deploy ourselves. Even if we were using Dependabot we would still need to do all the testing and deployment steps, which is the much bigger lift.
maxk85
Thanks for sharing! what do you do when fix comes with some breaking changes to the product?
giantg2
Depends on how much it breaks, how risky the vulnerability is, what mitigating controls are in place, etc. That's all part of vulnerability management and business risk management. But typically, you upgrade you the safe versions and fix anything that's broken.