Add snyk to fix vulnerabilities faster about node-gcm HOT 15 CLOSED

@mtrezza @ToothlessGear I think it would be great to have automated vulnerability fix PRs. I'm more inclined to use GitHub's built-in Dependabot, however only the repo owner (@ToothlessGear) can enable it, by visiting this page:
https://github.com/ToothlessGear/node-gcm/network/updates

Dependabot works similarly to Snyk by constantly scanning the project dependencies and alerting when a vulnerability is detected, and opening a PR with a fix if possible to do so in an automated way.

from node-gcm.

@mtrezza: I think I've set everything up now.
Regardless, I also gave you Collaborator rights on the repo, as well as npm.

from node-gcm.

@mtrezza Should be approved now.

from node-gcm.

@eladnava @ToothlessGear What do you think?

from node-gcm.

@mtrezza I'm open to give maintainer privileges to you, however maybe @eladnava and @hypesystem have some input too.

from node-gcm.

@ToothlessGear Thanks, I'll be happy to hear any input and obviously we would discuss any suggested changes to find the best way forward for the repo.

from node-gcm.

We usually use both in projects. snyk seems to be more aggressive when it comes to identifying vulnerabilities and seems to use a broader list. There are vulnerabilities that dependabot does not detect but snyk does, and sometimes vice versa, although snky tends to be more complete in my personal experience and as comparative studies show.

from node-gcm.

@mtrezza Sounds good, in both cases @ToothlessGear will need to set these up as the repo owner. Here are instructions for each one:

1. Snyk
2. Dependabot

from node-gcm.

@ToothlessGear How should we proceed with this?

from node-gcm.

Thanks! I'll take a look soon.

from node-gcm.

Any news?

from node-gcm.

It seems this has been addressed. I noticed Snyk just opened a PR. Closing.

It was a dependabot PR.

from node-gcm.

@ToothlessGear I've requested org access on Snky to set this up, you may have received an email.

from node-gcm.

It's strange that Snky doesn't seem to have opened even a single PR since it was added. But it seems to be set up properly. I've enabled Automatic dependency upgrade pull requests for the project (not the org), because I'd say we want dependencies always up-to-date, even if they don't have a vulnerability. Let's see if it creates more PRs now.

from node-gcm.

Snky is opening PRs, closing this.

from node-gcm.