Dependency update with Dependabot

[naveensrinivasan]

Background

Dependabot provides Automated dependency updates for go , docker , and GitHub actions.

Security updates

Dependabot security updates make it easier for you to fix vulnerable dependencies in the repository. If this feature is enabled, when a Dependabot alert is raised for a vulnerable dependency in the dependency graph in the repository, Dependabot automatically tries to fix it.
https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates

Don't want the dependencies to be upgraded automatically

Dependabot opens a PR to the repository, it gives the team an opportunity to review the commit diff's between the version changes and decide whether to merge those changes or not.

Without this, it is hard to keep track of dependencies and their security posture and upgrades

Here is an example of changes that dependabot recommends
https://github.com/naveensrinivasan/lnd/pulls

The recent fix for DNS #5738 is tracked and could have been compared much easily with something like this naveensrinivasan#5

[naveensrinivasan]

This is one of the advantages of using dependabot alerts about CVE dependencies