Closed Mic92 closed 1 year ago
cool, I've never used dependabot. It's the thing that opens pull requests with version updates?
Exactly. Each dependency bump will get a PR. Here an example: https://github.com/internet4refugees/beherbergung/pull/215
rebased to make CI green.
While reviewing the code I found a lot of reported outdated npm packages with open security vulnerabilities. Given the sensitive nature of this projects, it's therefore recommended to keep the project dependencies up-to-date automatically.