haskell / haskell/security-advisories
GitHub Dependabot support for Haskell packages
- Dominant language
- Haskell
- Stars
- 64
- Forks
- 27
- Avg merge
- 3h 39m
- Merged PRs (30d)
- 1
Description
## Story
As a haskell developer (who uses GitHub), I want Dependabot to support Haskell, so that
when new versions fix security issues, Dependabot will automatically create PRs that bump
the version bounds.
### Further discussion
For some languages, dependabot only works on lock/freeze files.
In Haskell land, some projects have a freeze file committed to the repo, and some do not.
IF it is easier to tackle the freeze file scenario first, that is fine. Do the easy thing and deliver
value for some users, then tackle the harder problem.
Contributor guide
Research direction
The issue names no repository files, tests, or entry points. Start by investigating the Dependabot freeze-file scenario described in the discussion, then determine what Haskell package metadata must be supported. Done means Dependabot can identify Haskell dependencies and create pull requests that bump their version bounds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100