Mend R/R - Renovate & Remediate

[cyberdef]

For those of you that don't know me, I work in the Global Security Team @ Trimble and started the security program back in 2015.
I'm also the assigned Mend Expert for Trimble and participate regularly in Mend's Advisory Board meetings.

TL;DR - we are activating Mend Renovate across all repos in E-Tools Github + Bitbucket.

The work is being done in conjunction with Mend, including Rhys Arkins (inventor of Renovate, now head of SCA+SAST@Mend) and other lead technical staff from Mend. I had the pleasure of meeting Rhys in person recently and he's happy to help us get the most out of the solution.

Initially it will be in what we're calling "silent mode" (ie no PR's for remediating vulnerable or outdated libraries) and will not require any intervention by teams. The aim of the first phase is to get a baseline of vulnerability info for everything sitting in the repos.

There will be a LOT more information available to teams as we progress this work, but I wanted to make people aware of this now as I often see people activating the open source edition of Renovate.

Reach out to me ([email protected]) if you have any questions.