Skip to main content
8 votes
Accepted

Does `npm audit` add any value when using `dependabot`

Dependabot and npm audit both poll the Node Security Working Group database for Node-based projects. However, Dependabot has the added ability to check dependencies in numerous other types of projects ...
Adam's user avatar
  • 196
5 votes

Why do companies use JFrog Artifactory or other repositories instead of Maven central repository?

Saved bandwith and faster downloads: Artifactory stores the artifacts that are downloaded from maven central. So if another developer needs the same dependencies they don't need to be downloaded again ...
jadephantom's user avatar
5 votes

What is recommended to document an IT technology stack, including their relationship to one another, in a graph database?

Considering your first paragraph, the organization you're describing is a highly siloed org, which is exactly what a DevOps organization tend to avoid. Considering this challenge, within DevOps ...
Tensibai's user avatar
  • 11.4k
5 votes
Accepted

Using requisite injection to order states

This turns out to be a known issue: The require_in requisite does not support everything that require does, mainly id does not support sls or state_id without specifying a state module. So by ...
Michael Mol's user avatar
  • 1,045
4 votes
Accepted

Constructing Dependencies from a Pillar in Saltstack

This templated SLS file works splendidly: {% if 'components' in salt.pillar.items() %} include: {% for component in salt.pillar.get('components').keys() %} - {{ component }} {% endfor %} {% endif ...
Michael Mol's user avatar
  • 1,045
3 votes

Does `npm audit` add any value when using `dependabot`

As per October 2021: GitHub Advisory Database now powers npm audit : "This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory ...
Alexandre Andrade's user avatar
3 votes
Accepted

How to manage Free and Open Source Software dependencies?

Any organization that needs the level of control you've specified is essentially forced into the preapproval process ("walled garden"). It's a pain for developers, but it's a necessary process to keep ...
Xiong Chiamiov's user avatar
3 votes

Constructing Dependencies from a Pillar in Saltstack

You can also do it like: {% if pillar['components'] is defined %} include: {% for component in pillar['components'] %} - {{ component }} {% endfor %} {% endif %} {% if pillar['components'] is ...
brousch's user avatar
  • 131
2 votes

How to manage Free and Open Source Software dependencies?

There are enterprise tools that manage these opensource dependencies namely Jfrog Artifactory with the Xray feature and Inedo ProGet with features for license filtering and vulnerability scanning. ...
Karl Harnagy's user avatar
2 votes
Accepted

Build Design - Docker vs Fedora's Mock

Docker is going to be far more well-known than Mock. I consistently see Docker used during build in companies that I work for. I think I have seen Mock before, but only because I am a Fedora user. ...
user2640621's user avatar
  • 1,405
2 votes
Accepted

Mitigating Maven Central risks as seen from the DevSecOps perspective

What could be a feasible way to motivate Maven and repository makers to establish some kind of early time warning, like issue special headers on download, or and additionally for example reject ...
AnoE's user avatar
  • 4,886
1 vote
Accepted

Cannot understand jenkins deployment error

I resolved the problem publishing the ivy.xml file to nexus too, adding publishivy="true" to my publishing task in my build.xml file.
rainman's user avatar
  • 121
1 vote

What package managers are supported on Microsoft hosted agents with CMake enabled?

According to this page, the hosted agent supports NuGet, npm, and Maven. It looks like it might also support pip. You could install cget using pip and then use cget to install your package. A bit of ...
jmcker's user avatar
  • 111
1 vote

Mitigating Maven Central risks as seen from the DevSecOps perspective

First of all there is one Maven central repository and that is Maven central. The website mvnrepository.com is just a search engine for Maven central. Secondly there is a gazillion of paid services ...
kazanaki's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible