[huksley]

Agree on how scary it is to do npm upgrade right now.

But I don't understand why Dependabot is bad but Mendral is good. Why Dependabot will be an attack vector and Mendrol will not?

[shad42]

Dependabot is focused on upgrading dependencies, and nothing else. One of your dep is outdated, here is an update.

Mendral is smarter when updating deps, it looks at newer version, scans for vulnerabilities or upgrade patterns that can put you at risk (eg. the update was published few hours ago, you should update it now).