We switched our main repo from Dependabot to Snyk a month ago. I was excited for the broader vulnerability scanning, but the actual day-to-day workflow is slower.
The biggest hit is in PR handling. Dependabot creates one PR per dependency update. Snyk groups multiple updates into a single PR. This sounds efficient, but it creates merge conflicts constantly. We have to manually resolve them or break the PR apart, which defeats the automation. Reviewing a mega-PR with 15 library updates is also much harder than reviewing 15 small, isolated changes.
Also, the Snyk bot comments on its own PRs with a lot of detailed vulnerability info, which is great, but it drowns out our team's review comments. We lose track of the conversation.
Has anyone else faced this? Is there a configuration trick to make Snyk behave more like Dependabot's one-PR-per-update style? Or is this just the trade-off for the better security database?
Still learning.