3 ms·
> […] silently gets pulled into your project. The core issue that caused all of OPs problems was that Renovate Bot claimed to have only updated one dependency
by wereHamster 8y ago
> […] silently gets pulled into your project.
The core issue that caused all of OPs problems was that Renovate Bot claimed to have only updated one dependency (@sourcegraph/codeintellify), but also updated another, unrelated one (sanitize-html). If you can't trust the tools around you not to lie to your face, all bets are off.
It doesn't matter whether our tools follow MSV or the opposite (LSV – Latest Version Selection?). We should always pin our dependencies to exact versions, and explicitly update them as needed. Renovate Bot (and its alternatives) attempt to automate that part. They send you notifications or even open pull requests, you can inspect the changelog of your dependencies and decide for yourself if the update is necessary (eg. because of security reasons) or if you prefer not to update out of fear of breaking something. Right now it seems Renovate Bot sucks at that, and should be improved accordingly.
- nicksnyder 8y agoRenovate Bot didn't do anything special. It ran exactly the same npm command that I would have run on the command line (update the single dependency), which would have produced the exact same result.
- wereHamster 8y ago> Renovate Bot didn't do anything special. Maybe it /should/ do something special though. Maybe it should stop using npm. If it says "I updated package X" and it really updated X /and/ Y, then it didn't do what it promised. Maybe it should say "I updated package X and maybe also others I don't know…" that would be more accurate to how it currently works.
- nicksnyder 8y agoThis pain isn’t really about Renovate Bot. You can pretend that it doesn’t exist or that your project isn’t using it. I should still be able to update a single dependency without updating unrelated things.