Skip to content

Commit

Permalink
[SEC-3364] Remove Dependabot (#883)
Browse files Browse the repository at this point in the history
Dependabot alerts are not applied to the users’ apps for the following reasons:
 1. We do not have any actual dependencies in our SDK, just peer and dev dependencies, which do not get installed in the user apps.
 2. Supposedly we had a dependency in the future, the package manager will not respect the versions in our yarn.lock, since the dependency resolution will be done in the user’s app according to our package.json not yarn.lock. (*)

References:
(*): A comment by one of Yarn creators, explaining the dependency resolution in an app vs a library: yarnpkg/yarn#838
  • Loading branch information
TheBuggedYRN authored and ymabdallah committed Feb 20, 2023
1 parent c1807cb commit 51dd4a3
Showing 1 changed file with 0 additions and 10 deletions.
10 changes: 0 additions & 10 deletions .github/dependabot.yml

This file was deleted.

0 comments on commit 51dd4a3

Please sign in to comment.