Add dependabot and fix High and Medium vulnerabilities #348

Activity

1. artursouza

   added

   kind/bugSomething isn't workingSomething isn't working

   P1

   size/S

   on Oct 6, 2020
2. artursouza

   changed the title [-]Run Synk scan and fix High and Medium vulnerabilities[/-] [+]Run Snyk scan and fix High and Medium vulnerabilities[/+] on Oct 6, 2020
3. artursouza

   changed the title [-]Run Snyk scan and fix High and Medium vulnerabilities[/-] [+]Add dependabot and fix High and Medium vulnerabilities[/+] on Oct 6, 2020
4. mukundansundar commented on Oct 11, 2020

   

   mukundansundar

   on Oct 11, 2020

   Contributor

   More actions

   Potential dependabot.yml file:

   version: 2
   updates:
     - package-ecosystem: "maven"
       directory: "/"
       schedule:
         interval: "daily"
       open-pull-requests-limit: 5
     - package-ecosystem: "maven"
       directory: "/sdk"
       schedule:
         interval: "daily"
       open-pull-requests-limit: 5
     - package-ecosystem: "maven"
       directory: "/sdk-actors"
       schedule:
         interval: "daily"
       open-pull-requests-limit: 5
     - package-ecosystem: "maven"
       directory: "/sdk-autogen"
       schedule:
         interval: "daily"
       open-pull-requests-limit: 5
     - package-ecosystem: "maven"
       directory: "/sdk-springboot"
       schedule:
         interval: "daily"
       open-pull-requests-limit: 5
     - package-ecosystem: "maven"
       directory: "/sdk-tests"
       schedule:
         interval: "daily"
       open-pull-requests-limit: 5

   The dependabot yaml changes will be only applied module by module independently. See here.

   Need to specify the directory where pom.xml is located for each module.

   This will cause build failures if the target-branch is master and if the updates are merged one by one to master branch.

   We might possibly use a separate develop branch with no build actions but as a target-branch for dependabot updates, merge all the corresponding updates to versions in all modules, then manually create a PR from develop to master branch once all the security updates for related dependencies in all modules are done. @artursouza I can probably continue to look at this if that is the way we want to move forward.
5. artursouza commented on Oct 12, 2020

   

   artursouza

   on Oct 12, 2020

   ContributorAuthor

   More actions

   Let's use the branch idea that you proposed (maybe calling it dependabot) and have a triggered workflow on that branch where DaprBot will automatically create a PR if unit tests passes.
6. artursouza

   added

   P2

   and removed

   P1

   on Oct 12, 2020
7. berndverst commented on Jun 29, 2021

   

   berndverst

   on Jun 29, 2021

   Member

   More actions

   @mukundansundar can we make this P1 and add it to the Java SDK 1.2 milestone?
8. siri-varma

   closed this as completedon Mar 13, 2026