Dependabot

[Sephsekla]

Now we're making use of a number of dependencies, should we enable Dependabot? This could auto-create PRs, or just flag security vulnerabilities.

[erikyo]

about Dependabot, no actually isn't needed since the code dependencies aren't reachable after building the plugin

[Sephsekla]

While that's true, there is a chance of vulnerabilities in compiled js, and if we end up using PHP via composer for non-dev stuff that won't be the case.

Regardless, I'd rather not have contributors installing vulnerable code if possible. There was a supply chain attack a while ago with an npm package that could wipe someone's hard drive on install.

[bacoords]

I guess I'd plus-one for dependabot (even though it can get really annoying). Agree the dependencies aren't really deployed yet but it seems like a basic hygiene move for this type of project.