Updates based on dependency security alerts

[paualarco]

Hello!

It would be lovely if scala-steward was able to update dependencies related to vulnerability alerts.

Is this a feasible feature? Would you consider adding it to this project? If so, I would be interested in contributing! I am very open to hear ideas/suggestions.

My idea is that we could maybe allow to pass this as an argument. The vulnerability alerts could dynamically be parsed from the github api dependabot alerts endpoint and then force the update to a non affected version.

[mzuehlke]

Do I understand the idea correctly and it is the same as #535 ?

[paualarco]

Yes, it overlaps. Although idea was not to flag updates related to vulnerability but allow to only update dependencies based on security alerts. But probably we could close this one and keep the discussion on other issue you linked.

[mzuehlke]

Got it ! Both ideas make sense 👍