Comment by huksley

Agree on how scary it is to do npm upgrade right now.

But I don't understand why Dependabot is bad but Mendral is good. Why Dependabot will be an attack vector and Mendrol will not?