Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I recommend Renovate over any other dependency update tools

jvt.me

Post reply on HN
Print view View original

31–40 of 76 posts

Re: Why I recommend Renovate over any other dependency update tools

#31

Post by k8sToGo »

riquito wrote: post #30
k8sToGo wrote: post #24

Earlier quoted context omitted.

I have a branch lock on dev and main so that you can only merge through PR. So I created a branch from dev called "renovate_updates". In the renovate config I set the baseBranch config parameter to this branch. I also enabled automerge and minimumReleaseAge. On GitHub I created two actions: 1. It gets triggered on the 14th and the 1st of a month and creates a PR from renovate_updates to dev and assigns it to me. I us…

What strategy do you use for conflicts during the rebase of renovate_updates? (which most of the time would occur because you eagerly updated something on dev)?

That’s a good point. My repo doesn’t change that often. But for me the source of truth is always dev.

Re: Why I recommend Renovate over any other dependency update tools

#32

Post by zer00eyz »

keybored wrote: post #14

Why does it seem to these tools have converged on the bot-makes-PR implementation? Why not a tool that bumps dependencies and let’s you propose yourself? I can’t use one of these tools because the integration is GitHub-only.

>> Why not a tool that bumps dependencies and let’s you propose yourself?

SO it opens an issue and gives you a patch file... Or emails it to you?

> Why does it seem to these tools have converged on the bot-makes-PR implementation?

Because git and the PR is the common choke point that every one knows and loves. A lot of dev's look down on "patches"... there are tons of people who happily use linux who think that all kernel devs are stupid cause of bugzila/patches and email could not possibly work.

Re: Why I recommend Renovate over any other dependency update tools

#33

Post by aswihart »

Figuring out whether the upgrade is safe is a hard problem. I've found renovate most successful in frontend JS projects where you have a ton of dependencies all with new versions coming out all the time, most of which are non-breaking, and where the danger of a bad upgrade is not that large.

For backend work or once you've gotten the easy stuff out of the way you really need to review the changelog, assess the risk, and do the upgrade safely (disclosure: my startup Infield is in this space).

Re: Why I recommend Renovate over any other dependency update tools

#35

Post by nikolay »

Dependabot is the biggest source of PR spam for me as it's config is so simplistic, you can't easily make it group upgrades. So, when I see suddenly almost a hundred PRs created, I do the upgrade myself, push it, and then Dependabot closes the PR, but I love the hundreds of emails around this process, too.

Re: Why I recommend Renovate over any other dependency update tools

#36

Post by keybored »

zer00eyz wrote: post #32
keybored wrote: post #14

Why does it seem to these tools have converged on the bot-makes-PR implementation? Why not a tool that bumps dependencies and let’s you propose yourself? I can’t use one of these tools because the integration is GitHub-only.

>> Why not a tool that bumps dependencies and let’s you propose yourself? SO it opens an issue and gives you a patch file... Or emails it to you? > Why does it seem to these tools have converged on the bot-makes-PR implementation? Because git and the PR is the common choke point that every one knows and loves. A lot of dev's look down on "patches"... there are tons of people who happily use linux who think that all k…

Patch files? Normal tools change files. If I `sed -i` in my project I just change the files in my project. Then I (separately) can add and commit them. Same for (for example) linting tools. This bot-PR workflow is outside of that normal.

Re: Why I recommend Renovate over any other dependency update tools

#37

Post by MajimasEyepatch »

keybored wrote: post #14

Why does it seem to these tools have converged on the bot-makes-PR implementation? Why not a tool that bumps dependencies and let’s you propose yourself? I can’t use one of these tools because the integration is GitHub-only.

If you had to submit the PR yourself, you’d have to remember to do it in the first place (and take the time to do it). Bumping a bunch of patch version numbers has never been the hard part and isn’t really what these tools solve. Their purpose is to reduce the effort involved to an absolute minimum so there are no excuses to fall behind on updates. Some of these tools, like Renovate, even have the ability to automatically merge the PR if the tests pass, meaning there’s zero human involvement.

If you had to submit the PR yourself, then these tools would be no different than an automated Jira ticket that’s created once per sprint.

(The actual hard part of all this is having good, meaningful, automated tests, but that can’t be solved by a bot.)

Re: Why I recommend Renovate over any other dependency update tools

#38

Post by jml78 »

aswihart wrote: post #33

Figuring out whether the upgrade is safe is a hard problem. I've found renovate most successful in frontend JS projects where you have a ton of dependencies all with new versions coming out all the time, most of which are non-breaking, and where the danger of a bad upgrade is not that large. For backend work or once you've gotten the easy stuff out of the way you really need to review the changelog, assess the risk,…

At my company, I feel just the opposite. Our frontend JS projects are lacking in enough unit, integration, and e2e that most of those devs are scared to touch any dependencies.

Where on our backends, we have such high code coverage, quality integration tests, the backend devs are never nervous about updating dependencies.

EDIT: I will also say, we are purely microservices so that does help in this regard.

Re: Why I recommend Renovate over any other dependency update tools

#39

Post by partdavid »

keybored wrote: post #36
zer00eyz wrote: post #32

Earlier quoted context omitted.

>> Why not a tool that bumps dependencies and let’s you propose yourself? SO it opens an issue and gives you a patch file... Or emails it to you? > Why does it seem to these tools have converged on the bot-makes-PR implementation? Because git and the PR is the common choke point that every one knows and loves. A lot of dev's look down on "patches"... there are tons of people who happily use linux who think that all k…

Patch files? Normal tools change files. If I `sed -i` in my project I just change the files in my project. Then I (separately) can add and commit them. Same for (for example) linting tools. This bot-PR workflow is outside of that normal.

You mean on some individual person's laptop when that person remembers to run it?

Re: Why I recommend Renovate over any other dependency update tools

#40

Post by Terretta »

abathur wrote: post #18

Thread a few months ago ~about a risk associated with getting habituated to automatic dependency-update PRs and looking at them less critically: https://news.ycombinator.com/item?id=37680443

There's a risk to wearing your seatbelt and driving off a bridge into water as well.

Something to be aware of, but not a reason to ditch the belt.

Post reply on HN