3 ms·
That sounds like exactly what it does? How would you describe it?
by eikenberry 4y ago
That sounds like exactly what it does? How would you describe it?
- metadat 4y agoUsually opens PRs too minor to be worthwhile.
- viraptor 4y agoI guess it depends on the expectations, but I want dependabot to open a PR for every single minor update. The minor ones take a second to see and click merge if your tests are passing. Actually, "too minor" does not exist for me.
- eikenberry 4y agoThey update a single dependency. Pretty much what you'd want I think. Takes <1 minute to skim over the update and merge it. Do you prefer to let your dependency updates build up and update them one a sprint/quarter? I've done that in the past and so far using dependabot (use it at work) seems easier.
- metadat 4y agoI don't like being interrupted randomly by a bot just for a dependency bump. It feels like I'm working for the computer instead of the other way around. To be clear, I'm not arguing to not update vulnerable dependencies, though often enough my project doesn't actually use the vulnerable part of said dependency, effectively making the whole exercise somewhat pointless, akin to virtue signaling for dependencies. Sounds dumb, right? For work projects, I appreciate it. For my open source experiments, not so much. If there was a way to let the bot do everything from beginning to end, merging and possibly breaking everything without manual intervention, that could be exciting! (Probably in a bad way? Milage will surely vary!)
- viraptor 4y ago> Sounds dumb, right? Realistically, no, I don't think so. You're making a choice between updating everything as soon as possible, or batching everything until it's actually needed. Both valid approaches, but I prefer the first. It saves you when one day you discover that you really need to do some critical update... but now it also depends on updates to foo, bar and baz, and changes to your code because some API got deprecated and you need to figure out how they impacts your external interface. I'd rather deal with 100 trivial/pointless updates trickling in daily instead of one of those situations.
- lozenge 4y agoSupply chain attacks are already scary enough, but with package updates being auto merged into tens of thousands of GitHub repositories? Oof!