Currently using DependencyCheck/nvd from a pipeline. Would be cool to use dependabot though

I don't belive that dependabot is a good thing, but you can use clj -X:deps mvn-pom to create a pom file, commit it, then github will do the thing for you. dependabot IMHO has these same issues: https://overreacted.io/npm-audit-broken-by-design/

that article severely lacks nuance btw typical "famous twitter guy" syndrome most decent setups decouple dev/test from prod dependencies, if npm doesn't do that by default it's their problem

https://github.com/rm-hull/lein-nvd/ is a thing btw compatible with deps.edn also

IIRC, dependabot doesn’t do transitive deps, so it’s kind’a useless.

We have set up a lein-nvd job which runs nightly and on commits, and lein-nvd does search through the transitive deps as well.

@U45T93RA6 and myself have a friendly argument about the finer details of this 🙂

lein-nvd is the way to go, I tried dependabot and generating a pom.xml does trigger it, but no transitive dependencies detection 😮.

Thanks for the heads-up @U04V5VAUN