61–70 of 76 posts
Earlier quoted context omitted.
You mean on some individual person's laptop when that person remembers to run it?
Like most things.
Earlier quoted context omitted.
I've been dumbfounded that GH hasn't invested in the space. There's tons of obvious surface area still available for automation. A one-off project of mine tries to improve supply-chain license management for projects [1]. I got bit once by an MIT licensed project that accidentally took a GPL dependency a couple versions later. That was a pain to notice without analyzing transitive dependencies. Never again. [1] https…
It's not so dumbfounding when you uncover what Microsoft's real goals and aspirations are for Github.
So, I picked up a pretty easy process I've used for the last 10 years (at decade old small company with plenty of legacy code, Microsoft, & now a startup using go/rust/js) Every Monday I update dependencies. Review breaking changes, get to know what CVEs are out there, glance over changelogs It takes less than an hour a week. It keeps me up to date on our dependencies
Cloudflare adopted Renovate when I worked there. Not sure if it was the config wasn’t good (we did try to wrangle with it a bit by customizing), but I found it to be a lot more pain that it was worth. PRs that wouldn’t build would be opened, trivial dependency updates that weren’t worth the PR time would be proposed, etc. There’s also the security aspect of supply chain attacks of “button press” updates. I think havi…
Isn't that exactly what you want from the dependency update system? If some dependency bump breaks the build, why wouldn't you want to know about it? And if not, how would this system know that the PR will fail before opening it? I'm not sure I get what behaviour you expect.
Ugh, no. Stopped using Renovate when I discovered that it will happily propose a PR update for completely incompatible and conflicting dependencies. It literally looks at the latest version of each dependency alone, without considering if this will make a conflict. Author insists this is a problem with all package managers, that it's impossible to write a tool that doesn't behave like this, and that manually grouping…
This is significant. Where did you read this? I found: https://github.com/renovatebot/renovate/discussions/26917
I imagine any plugin ecosystem of dependent packages would have the same issue.
Earlier quoted context omitted.
Last time I tried (which is >2y ago, so things might have improved), dependabot seemed like an afterthought for GitHub. For example, at some point GitHub introduced a change that prevented CI builds triggered by forks from accessing secrets in CI variables. This made sense from a security perspective (although I would have a preferred a hard failure instead of variables silently being set to empty), but it also appli…
Oh yes, https://github.com/dependabot/dependabot-core/issues/3253 . I wouldn't go so far as saying it was locked because it was too uncivil, mostly just because "additional commentary wasn't adding value" ;) Your read on the situation is spot on, and no, it doesn't look like it's been "fixed" (mostly because "fixing it would re-introduce the same potential vulnerability).
A few years later more than 30 projects using it and almost all of that growth happened naturally: https://gitlab.com/gitlab-org/frontend/renovate-gitlab-bot
We operate on a fork (5 commits or so) which contains some hacks to support a forked workflow on GitLab and some minor adjustments for that workflow. Really need to upstream some of it: https://gitlab.com/gitlab-org/frontend/renovate-fork/-/merge...
The author was always super kind, responsive and accommodating.
Cloudflare adopted Renovate when I worked there. Not sure if it was the config wasn’t good (we did try to wrangle with it a bit by customizing), but I found it to be a lot more pain that it was worth. PRs that wouldn’t build would be opened, trivial dependency updates that weren’t worth the PR time would be proposed, etc. There’s also the security aspect of supply chain attacks of “button press” updates. I think havi…
Earlier quoted context omitted.
Like most things.
But the whole point is not to have to do that. What you're asking for is basically just `npm upgrade` or `cargo upgrade` or whatever? The point of Renovate, Dependabot etc. is exactly the automated/scheduled running of those package manager updates.
Earlier quoted context omitted.
Patch files? Normal tools change files. If I `sed -i` in my project I just change the files in my project. Then I (separately) can add and commit them. Same for (for example) linting tools. This bot-PR workflow is outside of that normal.
A PR is easy to automate, hook into, an preserves ownership of the commit. Yes it bypasses YOUR workflow, but a PR works for everyone who uses GitHub. If you want something else that works for everyone who uses GitHub it's an issue, or an email with a patch file. Why a patch file. DO you want to own the change the bot suggested? There are a lot of orgs where the ownership matters more than the linting. You could just…