I am currently thinking about the best way to organize libraries in my team's projects.
A colleague of mine has set up renovate to update dependencies automatically, which seems very optimistic to me: you have to trust that updating the dependency does not break the code. Even if you configure renovate to update dependencies only when the semantic version update is a minor or bugfix.
Renovate floods my github notifications, especially when the dependencies are internal libraries that we often update because we are in the development phase.
I smell something wrong in it and I would like to catch advices from different point of view.
Imho, if it's not broken, don't fix it.
Here's what I use for some of my libs: There are bots which only automatically update dependencies when security issues become known (I use Snyk). They create pull requests and you can handle them when you have time. If you have good CI, then every pull request should also automatically be checked (for example on Travis), so that all tests pass. That also means that you need to have extensive unit tests for your library or application.
Hashnode is a friendly and inclusive dev community.
Come jump on the bandwagon!
💬 Ask programming questions without being judged
🧠 Stay in the loop and grow your knowledge
🍕 More than 500K developers share programming wisdom here
❤️ Support the growing dev community!
You can use branch automerge instead of PR automerge for internal dependencies like that, and skip the notifications. Alternatively use Octobox.io for better notification filtering than GitHub's native interface.