Go Library Maintainer Critiques GitHub's Dependabot for False Positives

Filippo Valsorda, a Go library maintainer, has called for developers to disable GitHub's Dependabot due to its frequent false positives, which he claims lead to alert fatigue and ultimately reduce security. Valsorda, who previously led the Go security team at Google, recently published a security fix for the filippo.io/edwards25519 library, which implements the EdDSA cryptographic algorithm.