dependabot-core VS learnxinyminutes-docs

Oh yes, https://github.com/dependabot/dependabot-core/issues/3253. I wouldn't go so far as saying it was locked because it was too uncivil, mostly just because "additional commentary wasn't adding value" ;)

Your read on the situation is spot on, and no, it doesn't look like it's been "fixed" (mostly because "fixing it would re-introduce the same potential vulnerability).

Storybook is great and all, but these days nearly every Dependabot alert I get is about a sub-dependency of Storybook. Since Dependabot doesn't currently allow you to ignore dev dependencies and only check production dependencies [0], this makes Storybook a Big Noise Generator and every time I dismiss another alert from it, I can't help but wonder if there's a better option out there.

[0] https://github.com/dependabot/dependabot-core/issues/2521

P.S. While this being a powerful and handy tool itself, it is only a part of Dependabot’s capabilities. If you are interested, you’ll find more about them in the GitHub docs.

Hello! I'm using Helm in K8s and curious if there is a solution that could keep tabs on the deployed chart dependency versions and either alert us when something is out of date or when a new release is available. Does this exist? I was thinking something like Dependabot or Renovate, but neither seems to be able to manage this.

- https://github.com/dependabot/dependabot-core

An important point is that this kind of metadata often needs to be accessible from outside the build system itself. You need that for example in order to integration with renovate-bot or github's dependabot, to check your dependencies against CVEs, to build SBOMs and various other additional tasks that are not part of the build itself, but related to the build's metadata. This is all functionality I don't want to reimplement, I want to use what's already out there. And for that the build system needs to have some minimum amount of compatibility with existing standard metadata files like pom.xml or build.gradle

To avoid any potential data breaches, it is recommended that users upgrade to a patched version of MinIO (RELEASE.2023-03-20T20-16-18Z) and integrate security tooling such as docker-cli-scan or use Github’s built-in monitoring for supply chain vulnerabilities, which already contains a record referencing this vulnerability.

I recognize that it does not handle chart updates, but it's might still ease the burden of applying minor releases easily etc. For the chart versions themselves, unfortunately dependabot does not support this and will not, but something like renovatebot does. Could be worth looking into as a dual approach

Disclosure: Renovate author

Renovate is indeed AGPL, but if you're just running it as a CLI, do you think there's anything to "watch out for"? It does not make any project you run it against AGPL, that's for sure.

Also you should be aware that dependabot-core, which dependabot-gitlab wraps, is not technically Open Source at all: https://github.com/dependabot/dependabot-core/blob/main/LICE...

Waiting for Yarn v2/v3 support in Dependabot has been a saga.

https://github.com/dependabot/dependabot-core/issues/1297

> Sure, maybe for some esoteric edge cases, but 5 mins on https://learnxinyminutes.com/ should get you 80% of the way there, and an afternoon looking at big projects or guidelines/examples should you another 18% of the way.

Not for C++, and even for other languages, it's not the language that's hard, it's the idioms.

Python written by experts can be well-nigh incomprehensible (you can save typing out exactly one line if you use list-comprehensions everywhere!).

Someone who knows Javascript well still needs to know all the nooks and crannies of the popular frameworks.

Java with the most popular frameworks (Spring/Boot/etc) can be impossible for a non-Java programmer to reason about (where's all this fucking magic coming from? Where is it documented? What are the other magic words I can put into comments?)

C# is turning into a C++ wannabe as far as comprehension complexity goes.

Right now, the quickest onboarding I've seen by far are Go codebases.

The knowledge tree required to contribute to a codebase can exists on a Deep axis and a Wide axis. C++ goes Deep and Wide. Go and C are the only projects I've seen that goes neither deep nor wide.

Learn x in y minutes: Concise tutorials to learn various programming languages and tools quickly.

StackOverflow's making their own competing LLM for all this stuff.

IMO, one of the biggest problems with the way people use LLMs right now, is that they're being treated as a single oracle: to know Java, it must be trained on examples of Java.

It would be much better if their language comprehension abilities were kept separated from their knowledge (and there are development efforts in this direction), so in this example it would be trained to be able to be able to read a Java tutorial rather than by actually reading a Java tutorial, so when the overall system is asked to write something in Java, the language model within the system decides to do this by opening https://learnxinyminutes.com and combining the user query with the webpage.

I think this will help make the models more compact, which is a benefit all by itself, but it would also mean that knowledge can be updated much more easily.

Someone would have to actually do this in order to see if those benefits are worth the extra cost of having to load a potentially huge a tutorial into the context window, and likewise the extent to which a more compact training set makes the language comprehension worse.

The project was created and is maintained by Adam Bard, but is open sourced with over 1.7k contributors since 2013

https://github.com/adambard/learnxinyminutes-docs

So you have studied programming for at least 5 years, what kinds of programs have you written? Apparently you have already applied your skills, since you have "created a good reputation among developers"? Why a time-frame of 20 years, why not 20 months or 20 weeks? Heck, you can learn a lot in even 20 days!

Once you have learned a few languages, libraries and frameworks then learning new stuff becomes much easier. At that point I'd recommend to check the website https://learnxinyminutes.com. Meanwhile, continue asking questions here and elsewhere :)

An other tip, if you are into computer science and algorithms stuff I recommend you try to solve problems which are posted at https://codegolf.stackexchange.com. You don't need to try solving them in less than X characters, but just to get them solved by any means necessary. And don't take too much bad influence from the posted solutions.

If you want a brief overview, go to https://learnxinyminutes.com/ and look for Javascript. I guess it should be roughly the time it took to learn C++ or possibly less, but JS has its own quirks. Often learning a second language is difficult as the first.

Very light compared to the other resources people have linked for you, but I love https://learnxinyminutes.com/