Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I recommend Renovate over any other dependency update tools

jvt.me

Post reply on HN
Print view View original

71–76 of 76 posts

Re: Why I recommend Renovate over any other dependency update tools

#71

Post by [deleted] »

keybored wrote: post #45
MajimasEyepatch wrote: post #37

Earlier quoted context omitted.

If you had to submit the PR yourself, you’d have to remember to do it in the first place (and take the time to do it). Bumping a bunch of patch version numbers has never been the hard part and isn’t really what these tools solve. Their purpose is to reduce the effort involved to an absolute minimum so there are no excuses to fall behind on updates. Some of these tools, like Renovate, even have the ability to automati…

> If you had to submit the PR yourself, you’d have to remember to do it in the first place (and take the time to do it). Bumping a bunch of patch version numbers has never been the hard part and isn’t really what these tools solve. Their purpose is to reduce the effort involved to an absolute minimum so there are no excuses to fall behind on updates. Some of these tools, like Renovate, even have the ability to automa…

[deleted]

Re: Why I recommend Renovate over any other dependency update tools

#72

Post by OJFord »

keybored wrote: post #69
OJFord wrote: post #61

Earlier quoted context omitted.

But the whole point is not to have to do that. What you're asking for is basically just `npm upgrade` or `cargo upgrade` or whatever? The point of Renovate, Dependabot etc. is exactly the automated/scheduled running of those package manager updates.

Sigh. The answer to why they are this way is that it’s the whole point that they are this way.

Well yes? You're complaining that a motorbike has an engine when you're perfectly capable of and would rather power it with your own two legs.

Re: Why I recommend Renovate over any other dependency update tools

#73

Post by graynk »

misnome wrote: post #54

Ugh, no. Stopped using Renovate when I discovered that it will happily propose a PR update for completely incompatible and conflicting dependencies. It literally looks at the latest version of each dependency alone, without considering if this will make a conflict. Author insists this is a problem with all package managers, that it's impossible to write a tool that doesn't behave like this, and that manually grouping…

> Author insists this is a problem with all package managers, that it's impossible to write a tool that doesn't behave like this

Is the author wrong? Dependabot functions the exact same way. How would you even go about solving this?

Re: Why I recommend Renovate over any other dependency update tools

#74

Post by keybored »

OJFord wrote: post #72
keybored wrote: post #69

Earlier quoted context omitted.

Sigh. The answer to why they are this way is that it’s the whole point that they are this way.

Well yes? You're complaining that a motorbike has an engine when you're perfectly capable of and would rather power it with your own two legs.

What a great comparison.

Re: Why I recommend Renovate over any other dependency update tools

#75

Post by tiborsaas »

noahtallen wrote: post #50
tiborsaas wrote: post #28

Earlier quoted context omitted.

It's the dependency updates. It doesn't consider if the update makes sense or not. If it fixes vulnerabilities it must be updated, but just for the sake of updating, I don't see the point.

If you don’t want to update dependencies frequently, then you should probably stop using (or reconfigure) the tool whose primary purpose is to help you update dependencies more frequently ;)

Well, I can't not use it since it's a company wide policy, but I agree with you.

Re: Why I recommend Renovate over any other dependency update tools

#76

Post by rco8786 »

HumanOstrich wrote: post #34
rco8786 wrote: post #10

Dependency updating and API version updating seem like great use cases for AI agents. “AI, update this file from API V1 to API V2”

How about no.

Why not? It's a task that is not deterministically automatable, but has similar enough problems (changing method signatures, etc) that make it suitable for AI to learn from past examples and then apply to your codebase. And these are typically also accompanied by changelogs that can get injected into the prompt, etc.

I'm not some sort of AI fanboy. This just seems like a pretty decent use case.

Post reply on HN