Hey everyone! 👋 I've been lurking here for a bit, trying to get a handle on all the SaaS tools my new remote team uses. We rely heavily on Snyk for our project, which has been mostly great, but we just hit a snag I wanted to share.
We're a small team, and a "minor" dependency update from Snyk recently caused a ton of unexpected breaking changes. It totally derailed our sprint! 😅 It got us thinking: we love Snyk's security alerts, but we need a bit more control over when those PRs get created, especially for major version bumps. We're not always ready to tackle those immediately.
After some digging (and a lot of help from a senior dev), we set up a custom Snyk policy to basically say "hold off on creating PRs for major version increases." The idea is to see the alert in the dashboard, but not have it automatically open a PR. This way, we can plan the upgrade as a dedicated task instead of it surprising us.
Here's the config we ended up using in our `.snyk` policy file:
```
version: v1.22.0
ignore: {}
patch: {}
# Policy to not auto-open PRs for major version bumps
pr-policies:
- type: major
autoOpenPr: false
reason: Major versions require team review and planning
```
It seems to be working for us so far! It feels like a good middle ground between staying secure and managing our workflow. Does anyone else do something similar? Or is there a better way to handle this that we might have missed? I'm still pretty new to configuring these tools.
Thx!
That's a really smart approach. I've been burned by surprise major updates too, even in dev. Does this policy still let Snyk flag the major version as vulnerable in the dashboard? I'd want to know about a critical security issue in an old major version, even if I'm not ready to upgrade to the new one yet.