denoland
Dependabot support/integration
Many companies rely on GitHub Advanced Security offerings to detect vulnerabilities in codebases. Dependabot is one such tool. Its ability to keep dependencies up to date is nice but from a security perspective its ability to create alerts on vulnerabilities in dependency versions is crucial. It currently supports various packages ecosystems including npm, pnpm, and yarn. It does not yet support deno.
Lack of Dependabot support/integration is a blocker for teams wanting to use deno in organizations that require Dependabot security alerting.
Ideas:
- Work with GitHub Advanced Security to help them support deno for security updates (ideally for general version updates and private repositories/registries too but at a minimum for security updates).
- Support some npm/pnpm/yarn lock file format. e.g. If deno can generate the package-lock.json file in the same format that npm does then users will be able to use Dependabot today without issues. This should work short term until more tools support deno.lock but it could also work long term as part of Deno's Node compatibility.
I know that Deno doesn't manage Dependabot, their priorities, etc. but I read Dependabot version updates now support the bun package manager – [GA] - GitHub Changelog and got confused as to why bun support arrived before deno support.
Two ideas:
- Invite Deno enthusiasts and users to upvote https://github.com/dependabot/dependabot-core/issues/2417 (e.g. via Discord).
- Find someone at GitHub to collaborate with to help make this a reality.
Security tooling support is one of the last things my company needs before Deno can be used on production software.
Instead of Dependabot, I am currently thinking of adding a deno manager to Renovate. Keep in mind that this is no easy task and is based solely on personal activity with no guarantee that it will achieve.
Renovate and Dependabot have different concepts and behaviors, but what they both have in common is that their implementation requires a large part of reverse engineering. Therefore, the implementation requires deep knowledge of the behaviour of Deno.
Also, Deno has its own dependency management (deno.json or HTTP import) in addition to being compatible with Node.js, so the implementation will be even more complicated than Bun. In addition, Dependabot is implemented in Ruby, so it will be difficult to contribute unless you can read and write Ruby to some extent.
I just discovered that Deno is not supported by dependabot. Please help GitHub to make it possible.
Or please provide custom github action to run deno outdated
It would be nice if someone on the Deno team put together a PR to Dependabot to add Deno. They now say they welcome new ecosystem and already added Bun support.
I have to think if a PR was opened for this, it would be merged.
