To automate upgrade of third-party dependencies

[oscard0m]

Opening a new issue here since I did not find an official ISSUE_TEMPLATE (checking the one on @pika/pack addressed me to pika community https://www.pika.dev/npm/@pika/plugin-standard-pkg/)

I would like to discuss a proposal to automate or improve at least the maintainance of some 3rd party dependencies (like @types/*) on the packages of this project.

Promoter of the issue: #119

Thanks

[FredKSchott]

happy to accept a PR that implements this

[oscard0m]

The approach I would follow is to rely on a third party GitHub App to manage this automatically. The ones I know are:

• Dependabot
• Greenkeeper
• Renovate

Since Greenkeeper it's no longer Open Source I would go for Dependabot or Renovate. Between Renovate and Dependabot no preferences.

At my company we are using Renovate because it allows you to self host the app and do fancy stuff but for a simple use case both work.

Also, GitHub acquired Dependabot so probably will fit nicely in the near future.

I can't open a pull request for the moment since this is a matter of installing the Github App but I can give you guidance on that if you like the approach.

Thanks @FredKSchott !

[oscard0m]

Hi @FredKSchott, Github released full integration with dependabot. With just a couple of clicks the update dependencies automation can be solved. Just FYI :)

[ayuhito]

@FredKSchott, @oscard0m - Thoughts on Depfu as the dependency manager instead? Looking at PRs right now... we've got a full page of just dependency updates polluting everything. Approving all of them one by one is time-consuming and I'm sure no one really wants to do that.

Depfu supports grouped updates, which could be scheduled on a weekly/bi-weekly/monthly basis and if you wish, can also auto-merge if all tests pass (although I personally just manually review since it's more of a monthly chore). Grouped updates would make everything far easier to manage.

I just would think that would make things far more manageable in this repo. :)

[oscard0m]

@FredKSchott, @oscard0m - Thoughts on Depfu as the dependency manager instead? Looking at PRs right now... we've got a full page of just dependency updates polluting everything. Approving all of them one by one is time-consuming and I'm sure no one really wants to do that.

Depfu supports grouped updates, which could be scheduled on a weekly/bi-weekly/monthly basis and if you wish, can also auto-merge if all tests pass (although I personally just manually review since it's more of a monthly chore). Grouped updates would make everything far easier to manage.

I just would think that would make things far more manageable in this repo. :)

I would be happy to give it a try, sure! I'm not sure of @FredKSchott thoughts and availability though