<story><title>Bringing supply chain security features to the Go community</title><url>https://github.blog/2021-07-22-github-supply-chain-security-features-go-community/</url></story><parent_chain><item><author>leo_bloom</author><text>GitHub&amp;#x27;s dependabot is causing a ton of &amp;quot;spam&amp;quot; in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories.&lt;p&gt;Is there an option to tell dependabot &amp;quot;make one PR per week at most, please, and bundle your changes&amp;quot;?</text></item></parent_chain><comment><author>greysteil</author><text>PM for security products at GitHub here (and one of the original authors of Dependabot).&lt;p&gt;Sorry to hear that. I wouldn&amp;#x27;t expect us to be telling you about 1-5 security issues a day - do you maybe have (non-security) version updates enabled? If so and they feel like spam to you I&amp;#x27;d recommend turning them off. (I wish I had a better suggestion, but until Dependabot supports grouped updates it sounds like it just isn&amp;#x27;t right for you.)&lt;p&gt;Dependabot doesn&amp;#x27;t support grouped updates yet but we hear the feedback and the team wants to work on them. Most of the investment in Dependabot recently gone towards improving our infrastructure and improving the experience for security updates. The team is still relatively small (it&amp;#x27;s 7 people), and supporting a service like this at GitHub scale is hard, but we&amp;#x27;re keen to keep improving.</text></comment>
<story><title>Bringing supply chain security features to the Go community</title><url>https://github.blog/2021-07-22-github-supply-chain-security-features-go-community/</url></story><parent_chain><item><author>leo_bloom</author><text>GitHub&amp;#x27;s dependabot is causing a ton of &amp;quot;spam&amp;quot; in our frontend (Angular) repositories, as it seemingly opens 1-5 PRs per day to bump random dependencies. I really hope this does not become common practice for our Go repositories.&lt;p&gt;Is there an option to tell dependabot &amp;quot;make one PR per week at most, please, and bundle your changes&amp;quot;?</text></item></parent_chain><comment><author>gherkinnn</author><text>Here&amp;#x27;s some information on these &amp;quot;vulnerabilities&amp;quot;: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;overreacted.io&amp;#x2F;npm-audit-broken-by-design&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;overreacted.io&amp;#x2F;npm-audit-broken-by-design&amp;#x2F;&lt;/a&gt;&lt;p&gt;As far as I&amp;#x27;m concerned, there&amp;#x27;s no need for Dependabot to create PRs. The notifications in the security tab are enough. Mark the unnecessary ones as benign.</text></comment>