[GitHub] [logging-log4j2] chenrui333 edited a comment on pull request #515: Update dependabot to track github action and dockerfile dependencies

[GitBox <gi...@apache.org>]

chenrui333 edited a comment on pull request #515:
URL: https://github.com/apache/logging-log4j2/pull/515#issuecomment-860848911


   > Can you please explain why we want to do this? To be honest, I don't find much value in dependabot in the first place. All it really tells me is what the most current version of a dependency is. That doesn't mean Log4j 2 should use it.
   
   Dependabot actually can do two things:
   - the regular dependency updates, like you said, it is really just a dependency notification thing (but it does have some sort of view in it, commit diff history, release notes, and compatibility score), I generally find it pretty convenient managing the dependencies, but it could be some maintenance overhead.
   - security patches, it would raise the security patch PRs
   
   By adding github action and dockerfile tracking, it would enable both for actions and dockerfiles.
   
   Let me know what you think.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org