Jeff Widman

Examples: * https://github.com/pallets/flask/blob/main/setup.py * https://github.com/pallets/flask/blob/main/setup.cfg

Make EnableClient* methods concurrent safe

10

In one of my apps, I'm hitting a data race error in `EnableClientHandlingTimeHistogram`. It looks like the problem is that the `EnableClient*` methods are not concurrent safe. The problem is...

Importing extensions via flask.ext.* is deprecated, use flask_* instead

3

Details: https://github.com/mitsuhiko/flask/issues/1135

Use errors.As()/errors.Is() syntax

2

Use the new `errors.Is()`/`errors.As()` syntax from `go 1.13`.

Try re-enabling deadlinks checking

3

This was originally disabled back in https://github.com/DataDog/glommio/commit/7daa35a7a7d379c7a5259aa446d8385241bd453b. That was four months ago, so perhaps the upstream issues have been fixed and we can re-enable this now. Worth a shot... 😄

What do you think about running `miri` as part of CI?

3

Given that this project uses unsafe, what do you think about adding `miri` to the CI pipeline? A little background on `miri`: https://www.ralfj.de/blog/2020/09/28/miri.html In fact, `miri` was already used to...

### Is there an existing issue for this? - [X] I have searched the existing issues ### Code improvement description If code is merged to `dependabot-core` via squash or merge-via-rebase,...

Remove `git` workaround since no longer run as `root`

1

As part of bringing `updater` into `core`, we stopped running as `root`. Now: 1. base core Dockerfile flips to [`USER dependabot`](https://github.com/dependabot/dependabot-core/blob/6d1c083a7e1d244096b024f255cea5eb9c232358/Dockerfile#L266) near the end 2. Updater Dockerfle has [`FROM dependabot/dependabot-core:$OMNIBUS_VERSION`](https://github.com/dependabot/dependabot-core/blob/6d1c083a7e1d244096b024f255cea5eb9c232358/Dockerfile.updater#L2)......

This adds a test case for an invalid version with dots. We expect the test to pass, but today it fails with: ``` eval error: Malformed version number string 1.8.0-failed.release.attempt...

PR's are getting opened that revert a bunch of deps

25

Seeing something seriously wrong with Dependabot PR's that just got opened in some private repos. This is for Golang code. It's trying to bump some basic open source libs such...