Why I recommend Renovate over any other dependency update tools

So, I picked up a pretty easy process I've used for the last 10 years (at decade old small company with plenty of legacy code, Microsoft, & now a startup using go/rust/js)

Every Monday I update dependencies. Review breaking changes, get to know what CVEs are out there, glance over changelogs

It takes less than an hour a week. It keeps me up to date on our dependencies

Re: Why I recommend Renovate over any other dependency update tools

#5

Post by gbrindisi » Fri, Apr 12, 2024, 1:49 PM UTC

I don't understand why Github does not invest more into Dependabot. Everyone need something like this, and Github is positioned to offer the best sca tool there is. And yet... stuff like grouping has only been recently added.

Anyhow, this is useful to rollout dependabot.yaml config at scale: https://github.com/github/evergreen

Re: Why I recommend Renovate over any other dependency update tools

#6

Post by pavel_lishin » Fri, Apr 12, 2024, 1:55 PM UTC

__s wrote: post #4

So, I picked up a pretty easy process I've used for the last 10 years (at decade old small company with plenty of legacy code, Microsoft, & now a startup using go/rust/js) Every Monday I update dependencies. Review breaking changes, get to know what CVEs are out there, glance over changelogs It takes less than an hour a week. It keeps me up to date on our dependencies

Across how many repos? My team owns a dozen.

Re: Why I recommend Renovate over any other dependency update tools

#7

Post by vlovich123 » Fri, Apr 12, 2024, 1:59 PM UTC

Cloudflare adopted Renovate when I worked there. Not sure if it was the config wasn’t good (we did try to wrangle with it a bit by customizing), but I found it to be a lot more pain that it was worth. PRs that wouldn’t build would be opened, trivial dependency updates that weren’t worth the PR time would be proposed, etc.

There’s also the security aspect of supply chain attacks of “button press” updates.

I think having reports sent to repo owners that they can review with the team on a periodic basis instead of click-through maintenance might be a better model but I also understand the desire for mindless automation of what seems like a chore.

Re: Why I recommend Renovate over any other dependency update tools

#8

Post by vlovich123 » Fri, Apr 12, 2024, 2:01 PM UTC

pavel_lishin wrote: post #6

__s wrote: post #4

So, I picked up a pretty easy process I've used for the last 10 years (at decade old small company with plenty of legacy code, Microsoft, & now a startup using go/rust/js) Every Monday I update dependencies. Review breaking changes, get to know what CVEs are out there, glance over changelogs It takes less than an hour a week. It keeps me up to date on our dependencies

Across how many repos? My team owns a dozen.

Sounds like you might be understaffed.

Re: Why I recommend Renovate over any other dependency update tools

#9

Post by __s » Fri, Apr 12, 2024, 2:02 PM UTC

pavel_lishin wrote: post #6

__s wrote: post #4

So, I picked up a pretty easy process I've used for the last 10 years (at decade old small company with plenty of legacy code, Microsoft, & now a startup using go/rust/js) Every Monday I update dependencies. Review breaking changes, get to know what CVEs are out there, glance over changelogs It takes less than an hour a week. It keeps me up to date on our dependencies

Across how many repos? My team owns a dozen.

Monorepos definitely make it easier. There's a use for dependency bots, especially when collected into one PR so that it can be treated like a newsletter. Was wanting to point out that good habits can go far, but if you're hitting limits then automation is a boon

Ideally if there's multiple repos maintenance can be divided amongst those repo's owners, & once you've divided work between multiple people it becomes more valuable to have a tool help maintain process. These tools need buy in, I've found sometimes they'll go ignored & then the list of PRs becomes mixed up with random dependency PRs

Re: Why I recommend Renovate over any other dependency update tools

#10

Post by rco8786 » Fri, Apr 12, 2024, 2:04 PM UTC

Dependency updating and API version updating seem like great use cases for AI agents.

“AI, update this file from API V1 to API V2”