Replies: 1 comment 1 reply
-
|
@jalilm which patches / security issues you are referring to? |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
I mean commits such as the following: where golang.org/x/net updated from 0.54.0 to 0.55.0, the 0.54 had some multiple high-severity CVEs: The CVE's were publish May 22nd and dependabot already patched them on May 26th (by upgrading), we could have automatically on such update released a new patch of v1.9 which would had been v1.9.0.1, instead for waiting until v1.10 to release such patches. |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
I noticed that dependabot is enabled for the repo, addressing security vulnerabilities and updating dependancies. Is it possible to close the circle by generating minor versions addressing these patches automatically rather than manually releasing a new version?
Beta Was this translation helpful? Give feedback.
All reactions