Turn Dependabot off

kept by eddie mar 01

Dependabot's version-based security alerts are noisy and less effective than static analysis tools that check reachability of vulnerable functions.

Package Managers Need to Cool Down
A survey finds that while many package managers and update tools have adopted dependency cooldowns to prevent supply chain attacks, implementations vary wildly in naming, scope, and timestamp handling, and major ecosystems like Go, Maven, and Gradle still lack support.
also on Renovate, Dependabot, #security, #open-source, #developer-tools
How we built a software factory to drive Astro’s GitHub issue count to zero
Cloudflare and Astro maintainers deployed isolated AI subagents in GitHub Actions to automatically reproduce, diagnose, and verify bugs, cutting open issues from over 200 to ~30 and aiming for zero.
also on GitHub Actions, #automation, #open-source, #developer-tools
GitHub - withastro/flue: The sandbox agent framework.
Flue is a TypeScript framework for building autonomous AI agents with a programmable harness that provides sandboxes, tools, skills, and durable execution across local and cloud runtimes.
also on GitHub Actions, #automation, #open-source, #developer-tools