Re: can we get rid of dependabot?

2021-12-30 Thread Rob Tompkins
I believe that we already have begun to do this. -Rob > On Dec 30, 2021, at 6:16 PM, sebb wrote: > > Those of you who want to keep the robot, please use the instructions > to reduce the spam. > >> On Thu, 30 Dec 2021 at 22:51, Rob Tompkins wrote: >> >> >> On Dec 30, 2021, at 5:50 PM,

Re: can we get rid of dependabot?

2021-12-30 Thread sebb
Those of you who want to keep the robot, please use the instructions to reduce the spam. On Thu, 30 Dec 2021 at 22:51, Rob Tompkins wrote: > > > > > On Dec 30, 2021, at 5:50 PM, Matt Sicker wrote: > > > > There are tons of options to configure. The defaults are handy for smaller > > projects,

Re: can we get rid of dependabot?

2021-12-30 Thread Rob Tompkins
> On Dec 30, 2021, at 5:50 PM, Matt Sicker wrote: > > There are tons of options to configure. The defaults are handy for smaller > projects, but they are clearly spammy for larger ones like this. > > https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-up

Re: can we get rid of dependabot?

2021-12-30 Thread Matt Sicker
There are tons of options to configure. The defaults are handy for smaller projects, but they are clearly spammy for larger ones like this. https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates

Re: can we get rid of dependabot?

2021-12-30 Thread Rob Tompkins
> On Dec 30, 2021, at 5:37 PM, sebb wrote: > > On Thu, 30 Dec 2021 at 21:39, Rob Tompkins wrote: >> >> Guys. The fundamental argument underpinng all this is whether it’s better to >> have robot eyes on the code and human eyes on the code. Stop arguing one >> side or the other. We need to

Re: can we get rid of dependabot?

2021-12-30 Thread Gary Gregory
This feels like a "Don't shoot the messenger" issue: Some people really don't like this mail carrier and uniform ;-) Gary On Thu, Dec 30, 2021 at 5:37 PM sebb wrote: > On Thu, 30 Dec 2021 at 21:39, Rob Tompkins wrote: > > > > Guys. The fundamental argument underpinng all this is whether it’s >

Re: can we get rid of dependabot?

2021-12-30 Thread sebb
On Thu, 30 Dec 2021 at 21:39, Rob Tompkins wrote: > > Guys. The fundamental argument underpinng all this is whether it’s better to > have robot eyes on the code and human eyes on the code. Stop arguing one side > or the other. We need to find a way to do both successfully. The issue is *not* ab

Re: can we get rid of dependabot?

2021-12-30 Thread Rob Tompkins
Guys. The fundamental argument underpinng all this is whether it’s better to have robot eyes on the code and human eyes on the code. Stop arguing one side or the other. We need to find a way to do both successfully. > On Dec 29, 2021, at 1:57 PM, Phil Steitz wrote: > >  > >> On 12/29/21 8

Re: [VOTE] Release Apache Commons JCS 3.1 based on RC1

2021-12-30 Thread Bruno P. Kinoshita
Just remembered seeing some classes in JCS that had Blocking in the name. Maybe it is intentional to use that SecureRandom implementation. In which case I think the best option would be to re-write the test that fails on environments where /dev/random is slow. Cheers Bruno Sent from Yahoo Mail

Re: [VOTE] Release Apache Commons JCS 3.1 based on RC1

2021-12-30 Thread Bruno P. Kinoshita
Hi, Thomas has had a lot of patience troubleshooting this issue with me off-list (thanks heaps!). Not only remotely, but I think we are on opposite timezones too. Yesterday Thomas suggested to look at EncryptingSerializer, and also to look at the time that my machine was taking to get data fr

Re: can we get rid of dependabot?

2021-12-30 Thread Bruno P. Kinoshita
Hi, I would prefer a solution that fixes the email issue, but if it bothers others, I guess I could enable dependabot on my fork of commons-imaging, commons-lang, commons-text, or any other repository that I may RM one day. I use dependabot in other personal and $work projects and it's very he