diff --git a/docs/checks.md b/docs/checks.md index abb30db3166..006cba87843 100644 --- a/docs/checks.md +++ b/docs/checks.md @@ -305,7 +305,7 @@ low score is therefore not a definitive indication that the project is at risk. **Remediation steps** -- Signup for automatic dependency updates with [dependabot](https://dependabot.com/docs/config-file/) or [renovatebot](https://docs.renovatebot.com/configuration-options/) and place the config file in the locations that are recommended by these tools. +- Signup for automatic dependency updates with [dependabot](https://dependabot.com/docs/config-file/) or [renovatebot](https://docs.renovatebot.com/configuration-options/) and place the config file in the locations that are recommended by these tools. Due to https://github.com/dependabot/dependabot-core/issues/2804 Dependabot can be enabled for forks where security updates have ever been turned on so projects maintaining stable forks should evaluate whether this behavior is satisfactory before turning it on. ## Fuzzing diff --git a/docs/checks/internal/checks.yaml b/docs/checks/internal/checks.yaml index 5eadd94fa23..27567b4f776 100644 --- a/docs/checks/internal/checks.yaml +++ b/docs/checks/internal/checks.yaml @@ -71,7 +71,11 @@ checks: Signup for automatic dependency updates with [dependabot](https://dependabot.com/docs/config-file/) or [renovatebot](https://docs.renovatebot.com/configuration-options/) and place - the config file in the locations that are recommended by these tools. + the config file in the locations that are recommended by these tools. Due to + https://github.com/dependabot/dependabot-core/issues/2804 Dependabot can + be enabled for forks where security updates have ever been turned on so projects + maintaining stable forks should evaluate whether this behavior is satisfactory + before turning it on. Binary-Artifacts: risk: High tags: supply-chain, security, dependencies