Dependabot isn't very useful in my view. I would rather have static and build scans (Wiz, Checkmark, etc) telling me about vulnerabilities and blocking critical and highs. Then we can analyze if the vulnerability is exploitable in our system or not. If it is, we can upgrade and deploy ourselves. Even if we were using Dependabot we would still need to do all the testing and deployment steps, which is the much bigger lift.
Depends on how much it breaks, how risky the vulnerability is, what mitigating controls are in place, etc. That's all part of vulnerability management and business risk management. But typically, you upgrade you the safe versions and fix anything that's broken.
Dependabot isn't very useful in my view. I would rather have static and build scans (Wiz, Checkmark, etc) telling me about vulnerabilities and blocking critical and highs. Then we can analyze if the vulnerability is exploitable in our system or not. If it is, we can upgrade and deploy ourselves. Even if we were using Dependabot we would still need to do all the testing and deployment steps, which is the much bigger lift.
Thanks for sharing! what do you do when fix comes with some breaking changes to the product?
Depends on how much it breaks, how risky the vulnerability is, what mitigating controls are in place, etc. That's all part of vulnerability management and business risk management. But typically, you upgrade you the safe versions and fix anything that's broken.