Create PRs for sub-dependencies when there is a security vulnerability

Question

From on November 20, 2017 22:42

github recently alerted us to a downstream dep (in the gemfile.lock brought in from some other dep higher up) security issue, and suggested we make a change to the gemfile to force a newer version of the downstream dep. your bot didn't suggest such a change, but it would be sweet if it did.

happy to provide more context

Copied from original issue: dependabot/feedback#53

该提问来源于开源项目：dependabot/dependabot-core

Answer 1

Love that new feature from GitHub!

I'll have a think about what we could do here - I totally agree it would be good for Dependabot to create PRs for security issue in sub-dependencies.