Enable periodic checking of dependencies for vuln Python packages
Closed this issue · 1 comments
willfurnass commented
Dependabot doesn't seem to be working for this repo!
Could enable periodic checks with e.g. Safety or Trivy. The latter definitely understands poetry.lock files. The former can't read a poetry.lock directly but is still an option.
Best to implement as a GitHub Action (see also Issue #152) rather than hack these checks into our Travis configs.
willfurnass commented
Dependabot now seems to be working. Closing.