Automate dependencies update ? about protobuf-ts HOT 8 CLOSED

The readme says renovate supports lerna monorepos, which sounds like a good fit.

Do you have experience using renovate for a github project?

from protobuf-ts.

I have never used renovate on one of my repo but I see it used on a few repos.

One of the gotcha is that if you don't throttle it (i.e. once a week / a month) it could generate a lot of noise. See skylines.

from protobuf-ts.

I've had a quick look at the vulnerabilities:

npx lerna exec npm audit

Looks like all are dev dependencies. Which isn't surprising because we only have typescript as dependency, with the exception of @protobuf-ts/runtime-angular, which has some peer deps.

Keeping dev-deps up-to-date is very low priority for me. 99% of dependencies are related to building and testing, and I would prefer to move them as seldom as possible to keep the project maintainable.

Keeping on top of security updates is a different story. If, for example, lerna would get compromised, all packages published through lerna could become compromised.

TLDR: contributions for semi-automated security updates / notifications are welcome.

from protobuf-ts.

Not sure to get what you mean by

TLDR: contributions for semi-automated security updates / notifications are welcome.

but

I would prefer to move them as seldom as possible

I could probably take a look if you clarify this point.

Does it means that you would upgrade the deps ONLY for security reason ?

Thanks.

from protobuf-ts.

Does it means that you would upgrade the deps ONLY for security reason ?

Yes. I don't trust all those deps to be stable over updates. Have been burned by the fragile node eco-system too many times.

from protobuf-ts.

Then using dependabot is probably enough ? (it should be activated for public repository by default).

from protobuf-ts.

Possibly! Thanks for the hint. Giving it a try for some weeks...

from protobuf-ts.

Finally got to merging the first dependabot security PRs. npm audit still shows warnings, though.

To be clear, these were vulnerabilities in dev-dependencies, not in the published packages.

Closing this and letting dependabot do its thing.

from protobuf-ts.