We run "audit" as part of our test suite and have dependabot set up to automatically update dependencies. Works great if you have a comprehensive test suite.
Interesting idea to have a cron job though. I'm honestly not sure sure if that is necessary with dependabot. Time to ask :)
I maintain a lot of repos, so removing maintenance overhead is a big priority. Feel free to take a look at the setup here (all repos are set up the same way): github.com/blackflux
dependabot is not free for org github accounts.
Having npm audit as a part of test suite cause unpredictable behaviour, since usually you also run tests in order to deploy something to production for example. Your tests previously passed but the moment you started deploy or planned to deploy, you could get error from npm audit.
Dependabot is now part of github.com and completely free 🎉
(1) Not true (for open source that is).
(2) Right, absolutely agreed. We have a grace period depending on severity for that reason github.com/blackflux/js-gardener/b...
My preference is to have a failure and know about the security problem if it's severe. This should not be a problem if everything else in your pipeline is handled appropriately
We're a place where coders share, stay up-to-date and grow their careers.
We strive for transparency and don't collect excess data.