Clojurians Log v2

morning

morning

👋

good monday morning

morning!

Good Morning!

Morning!

mornin

morning

thx for the new clj-kondo @borkdude

Morning 🙂

I saw a little birdie on the tree outside my window so I guess spring is coming 😄

Morning

Morning

Whoo, new M1 Macbook Air arrived today.

@orestis Didn't you already have one?

Ah, that was you're wife's right? Congrats

Yep. I got the high end to get more space, and a USA keyboard. Now I can put it through the paces a bit more aggressively 🙂

So, wondering about security and CVE’s and such, we decided to see if github could help us. We now generate a pom.xml on each release, and lo and behold, github manages to parse that, and show us what it calls a “Dependency graph”, much like you see here for clj-commons/pomegranate https://github.com/clj-commons/pomegranate/network/dependencies But this doesn’t show transitive dependencies, only the ones that are declared in the pom.xml which is kind’a sucky because the vulnerabilities that we have are in the transitive deps. Anyone have any experience with this or figured out how to make it work?

@slipset I've not used it, but I think http://libraries.io is good for this stuff.

The thing is that we’ve found all the stuff we need to find by running the nvd plugin for lein,

https://github.com/rm-hull/lein-nvd

ah, so the goal is really for github to be better, rather than anything else.

But Manager wants to have this as a report which he can look at whenever he chooses, so we were hoping that github/dependabot could provide this report to Manager.

instead of me promising to run it once a week and send him an email.

If you only cared about the github thing (i.e. not using pom.xml for anything else) I could imagine a script which pulled the whole transitive dep list instead and put that in a pom.xml

You could also just setup a github action though I guess :D

Yup, but I was kind’a hoping that github security was a bit more than what it seems to be.

Anyways, good to see you back @dominicm 🙂

Was it noticed was it 😁. In the new year I decided to step back from the keyboard a little more. I've become a little detached from the real world, side effect of turning my hobby into my career I think. They've been blended together for so long now, it's hard to switch off in the evenings.

🙂

Anyways, bed time here.