Rename the Web package.json to stop Snyk PRs #3374
Conversation
✅ Deploy Preview for device-sdk ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
✨ Staging URL: https://preview-mongodbmongodb.gatsbyjs.io/realm/master/ 🪵 Logs |
|
As long as this doesn't cause Snyk to run and fail (file not found), I'm OK with it. |
|
@MongoCaleb No guarantees, but according to Snyk documentation + internal documentation, Snyk runs on a scheduled cadence determined by the org and checks all the projects for files that list dependencies. The best info I could find suggests it's looking for specific naming conventions, i.e. So - making our dependency file not match the naming conventions it scans for suggests it just "won't find" this dependency file and therefore won't make a PR. But changing the name doesn't "cause Snyk to run and fail" - it runs on a scheduled cadence we can't control for all of the org's repos, and changing the name means it shouldn't find anything that it thinks it should update. 🤞 |
Pull Request Info
After investigation to the Snyk integration, it seems we are unable to disable it for a specific directory or repository.
While we are evaluating long-term plans for the Web SDK test suite, getting unnecessary Snyk update PRs is disruptive and creates maintenance burden.
This PR renames the
package.jsonfile, which is one of the files that Snyk scans for, which should hopefully stop the Snyk dependency update PRs. The updated README provides instructions about the changes required to run the test suite locally and reinstate it in the future.