Nothing here yet.
Nothing here yet.
Been working remotely for the same time period, and not seeing people is the thing I absolutely love the most. I shall be working this way till the day I die. I don’t get a job to make friends, be social or even be liked. Work is for working, not work is for socializing and drinking and gaming and what not.
Jordan Holland Agreed, but Dependabot exists purely for security purposes and is an alerting tool first and foremost. It's not often that it automatically creates the PR for the fix and in the end, you still need to approve the merge so it leaves the decision 100% in the hands of the developer, it does not make the choices for you. Personally use the IDE plugin to inform me when package updates are available, I can then open the spec and just click "accept". That way the analyzer has a heart attack if there are breaking changes and I can simply "ctrl+z" and carry on with my life until I feel like dealing with it.
Just curious, what is your reasoning for wanting to automate this, packages are one of the few things that should be managed manually. The risk for breaking changes is pretty high, even in a well-tested application. The problem is many developers do not understand the purpose or meaning of semantic versioning and I have personally seen breaking changes come out with patch and even build releases, developers rewriting entire API's and publishing as a patch release, and this was not even on pre-V1 releases. One package, I recall 2.3.3 was working perfect and 2.3.3+1 had a new API. lol. While in theory this is a good idea, not sure it's something one ever wants to put into practice back in the real world.
