4 ms·

HN is great, can I chime in with some feedback too, for NuGet I’m seeing Dependabot open separate PRs for the same dependency that’s out of date in the one repo

by plasma 5y ago

HN is great, can I chime in with some feedback too, for NuGet I’m seeing Dependabot open separate PRs for the same dependency that’s out of date in the one repo that has multiple projects that relate to each other (they reference one another in csproj files). They thus also need to be updated together, but I wish one PR was opened to update the dependencies in all projects at once, instead of multiple PRs I to merge. PS: I think you should highlight dependabot updates on the Security tab in GitHub repo, I thought it was on before (but was actually just the security notices) because dependabot itself is hidden away in Insights -> Dependency graph -> Dependabot which was a bit surprising.

greysteil 5y ago
Feature requests always welcome! I'll pass it on to the Dependabot team.
- plasma 5y ago
  Thank you
  - asciimike 5y ago
    Let me know if https://github.com/github/roadmap/issues/148 https://github.com/github/roadmap/issues/148 is in the right spirit of what you're aiming for. I think that what will get implemented will be a bit broader (covering version updates and security updates) and will allow for grouping by manifest, language, vulnerability, and potentially arbitrary labeling in the config file.
    - plasma 5y ago
      Yep, that looks good to me, thanks!
jacobparker 5y ago
For NuGet, consider using centralized package references: https://github.com/NuGet/Home/wiki/Centrally-managing-NuGet-package-versions https://github.com/NuGet/Home/wiki/Centrally-managing-NuGet-... You get one file defining the set of all packages used in your repo (or some subset of your repo, etc.) and Dependabot will update this file directly. Individual projects can choose to use a package but won't specify the version. It requires that your projects are all in sync with package versions but (1) that sounds like what you want (2) it's usually the best thing.
- plasma 5y ago
  Thank you, looks like it’s still on preview but glad it’s being worked on.

by plasma 5y ago

greysteil 5y ago

Feature requests always welcome! I'll pass it on to the Dependabot team.

plasma 5y ago
Thank you
- asciimike 5y ago
  Let me know if https://github.com/github/roadmap/issues/148 https://github.com/github/roadmap/issues/148 is in the right spirit of what you're aiming for. I think that what will get implemented will be a bit broader (covering version updates and security updates) and will allow for grouping by manifest, language, vulnerability, and potentially arbitrary labeling in the config file.
  - plasma 5y ago
    Yep, that looks good to me, thanks!

jacobparker 5y ago

For NuGet, consider using centralized package references: https://github.com/NuGet/Home/wiki/Centrally-managing-NuGet-package-versions https://github.com/NuGet/Home/wiki/Centrally-managing-NuGet-... You get one file defining the set of all packages used in your repo (or some subset of your repo, etc.) and Dependabot will update this file directly. Individual projects can choose to use a package but won't specify the version. It requires that your projects are all in sync with package versions but (1) that sounds like what you want (2) it's usually the best thing.

plasma 5y ago
Thank you, looks like it’s still on preview but glad it’s being worked on.