TURN DEPENDABOT OFF

Summary from the TLDR InfoSec newsletter

Dependabot floods teams with noisy pull requests and misleading security alerts, and in Go projects, it rarely improves actual security. Filippo Valsorda breaks down why: the alerts often have no bearing on real risk, offer no package- or symbol-level filtering, and generate enough alert fatigue that teams start ignoring everything, including the alerts that matter. His recommended setup uses two scheduled GitHub Actions instead. The first runs govulncheck for reachability-based vulnerability scanning. The second runs tests daily against the latest dependency versions to catch breakage early without forcing constant upgrades. Together, they cut through the noise, slash false positives, and let teams take genuine security findings seriously.