Date
1 - 6 of 6
[DISCUSS] Add dependabot to update dependencies
Jan Jansen <faro...@...>
Hi
I would like to start a discussion to add dependabot as a tool to update our dependencies automatically.
This would also us to concentrate more on features and bugs without forgetting to update deps.
I added dependabot on my fork of JanusGraph without any config changes.
Any thoughts on this topic?
Greetings,
Jan
Jan
Florian Hockmann <f...@...>
+1 for dependabot. We frequently get notified about outdated dependencies that have security vulnerabilities. Hopefully, dependabot will also updates for most of those updates.
Am Mittwoch, 11. September 2019 14:29:19 UTC+2 schrieb Jan Jansen:
Am Mittwoch, 11. September 2019 14:29:19 UTC+2 schrieb Jan Jansen:
HiI would like to start a discussion to add dependabot as a tool to update our dependencies automatically.This would also us to concentrate more on features and bugs without forgetting to update deps.I added dependabot on my fork of JanusGraph without any config changes.Any thoughts on this topic?Greetings,
Jan
Oleksandr Porunov <alexand...@...>
+1 for dependabot.
On Thursday, September 12, 2019 at 10:54:01 AM UTC+3, Florian Hockmann wrote:
+1 for dependabot. We frequently get notified about outdated dependencies that have security vulnerabilities. Hopefully, dependabot will also updates for most of those updates.
Am Mittwoch, 11. September 2019 14:29:19 UTC+2 schrieb Jan Jansen:HiI would like to start a discussion to add dependabot as a tool to update our dependencies automatically.This would also us to concentrate more on features and bugs without forgetting to update deps.I added dependabot on my fork of JanusGraph without any config changes.Any thoughts on this topic?Greetings,
Jan
Florian Hockmann <f...@...>
It has been over a week now since Jan started this discussion and there were no objections. So I'm going to activate dependabot this week (not sure yet when exactly but I will post an update here once it's activated)
Am Freitag, 13. September 2019 08:01:42 UTC+2 schrieb Oleksandr Porunov:
Am Freitag, 13. September 2019 08:01:42 UTC+2 schrieb Oleksandr Porunov:
+1 for dependabot.
On Thursday, September 12, 2019 at 10:54:01 AM UTC+3, Florian Hockmann wrote:+1 for dependabot. We frequently get notified about outdated dependencies that have security vulnerabilities. Hopefully, dependabot will also updates for most of those updates.
Am Mittwoch, 11. September 2019 14:29:19 UTC+2 schrieb Jan Jansen:HiI would like to start a discussion to add dependabot as a tool to update our dependencies automatically.This would also us to concentrate more on features and bugs without forgetting to update deps.I added dependabot on my fork of JanusGraph without any config changes.Any thoughts on this topic?Greetings,
Jan
Florian Hockmann <f...@...>
Just a quick update: It takes a bit longer to activate dependabot as we need a solution for the CLA check. I'm currently working together with Jacob Palmer from the Linux Foundation on this which is why we now have first pull requests from Dependabot in the janusgraph-dotnet repo (where the CLA check is unfortunately still failing right now). You can follow the progress in this issue if you're interested.
Once it's working in janusgraph-dotnet, we can activate the bot also for our main repo.
Am Montag, 23. September 2019 14:23:39 UTC+2 schrieb Florian Hockmann:
It has been over a week now since Jan started this discussion and there were no objections. So I'm going to activate dependabot this week (not sure yet when exactly but I will post an update here once it's activated)
Am Freitag, 13. September 2019 08:01:42 UTC+2 schrieb Oleksandr Porunov:+1 for dependabot.
On Thursday, September 12, 2019 at 10:54:01 AM UTC+3, Florian Hockmann wrote:+1 for dependabot. We frequently get notified about outdated dependencies that have security vulnerabilities. Hopefully, dependabot will also updates for most of those updates.
Am Mittwoch, 11. September 2019 14:29:19 UTC+2 schrieb Jan Jansen:HiI would like to start a discussion to add dependabot as a tool to update our dependencies automatically.This would also us to concentrate more on features and bugs without forgetting to update deps.I added dependabot on my fork of JanusGraph without any config changes.Any thoughts on this topic?Greetings,
Jan
Florian Hockmann <f...@...>
We got the CLA check to pass (thanks to Jacob Palmer for his support again) and I enabled dependabot also for our main repo where we now also have the first PRs created by dependabot.
Note that we of course have to review them just like any other PR. For some dependency updates it might be trivial to merge them, but for others we might have to configure dependabot to only update within the current major/minor version or the update might not work at all / require manual work. As I said earlier, I think that these PRs still provide value even if we can't merge them as they at least notify us about an outdated dependency and a failed Travis build might already include useful information to get started on a more complicated dependency update.
The configuration of dependabot is quite straightforward as it's working through PR comments (like this one).
Am Dienstag, 8. Oktober 2019 13:26:00 UTC+2 schrieb Florian Hockmann:
Just a quick update: It takes a bit longer to activate dependabot as we need a solution for the CLA check. I'm currently working together with Jacob Palmer from the Linux Foundation on this which is why we now have first pull requests from Dependabot in the janusgraph-dotnet repo (where the CLA check is unfortunately still failing right now). You can follow the progress in this issue if you're interested.Once it's working in janusgraph-dotnet, we can activate the bot also for our main repo.
Am Montag, 23. September 2019 14:23:39 UTC+2 schrieb Florian Hockmann:It has been over a week now since Jan started this discussion and there were no objections. So I'm going to activate dependabot this week (not sure yet when exactly but I will post an update here once it's activated)
Am Freitag, 13. September 2019 08:01:42 UTC+2 schrieb Oleksandr Porunov:+1 for dependabot.
On Thursday, September 12, 2019 at 10:54:01 AM UTC+3, Florian Hockmann wrote:+1 for dependabot. We frequently get notified about outdated dependencies that have security vulnerabilities. Hopefully, dependabot will also updates for most of those updates.
Am Mittwoch, 11. September 2019 14:29:19 UTC+2 schrieb Jan Jansen:HiI would like to start a discussion to add dependabot as a tool to update our dependencies automatically.This would also us to concentrate more on features and bugs without forgetting to update deps.I added dependabot on my fork of JanusGraph without any config changes.Any thoughts on this topic?Greetings,
Jan