Add boto3 dependency to dependabot configuration - #13733
Merged
Merged
Conversation
We are approving a boto3 rev almost every single day at this point. Let's skip the patches and only focus on the minor revs
|
This pull request includes a Dependabot config that restricts updates for the boto3 package to semver-minor only, which can prevent automatic PRs for major releases and may cause critical security fixes released in a new major version to be missed. Consider allowing major updates for boto3 or adding a process to monitor and handle major-version security fixes.
Risk of Missing Security Patches in Major Version Updates in
|
| Vulnerability | Risk of Missing Security Patches in Major Version Updates |
|---|---|
| Description | The Dependabot configuration for the boto3 package is restricted to only semver-minor updates. This prevents Dependabot from automatically creating pull requests for major version updates. If a critical security vulnerability is fixed only in a new major version of boto3, this configuration will cause the security alert and fix to be missed, leaving the project vulnerable. |
django-DefectDojo/.github/dependabot.yml
Lines 15 to 18 in 80a60e2
All finding details can be found in the DryRun Security Dashboard.
Jino-T
approved these changes
Nov 18, 2025
valentijnscholten
approved these changes
Nov 18, 2025
blakeaowens
approved these changes
Nov 21, 2025
Maffooch
added a commit
to valentijnscholten/django-DefectDojo
that referenced
this pull request
Feb 16, 2026
We are approving a boto3 rev almost every single day at this point. Let's skip the patches and only focus on the minor revs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We are approving a boto3 rev almost every single day at this point. Let's skip the patches and only focus on the minor revs