Using Bots to Keep Dependencies Updated

Mon, 27 Mar 2023 15:18:33 +0000

Any real world Java project will likely use external dependencies.

As we’ve seen over the last few years, it’s important to keep these dependencies up to date. We used to have to manually check for updates, but fortunately these days there are tools available that can help us with this. Because, let’s be honest, most developers don’t enjoy maintaining applications.

We’d much rather be using cool new tools and/or language features, and solving interesting problems. Sorry, I mean: delivering business value! But we are responsible for keeping our dependencies up to date, so let’s make that as easy as possible.

Renovate: Dependabot Alternative

Fri, 28 Oct 2022 07:17:55 +0000

I won’t introduce Dependabot . Lots and lots of developers use it daily on GitHub. I do use it as well. However, it suffers from two drawbacks:

While it’s perfectly integrated with GitHub, integrations with other platforms are less seamless.
It’s limited in the list of ecosystems it supports For example, I generally use Docker Compose files for my demos. When necessary, I use Kubernetes. Dependabot supports none.Worse, Dependabot doesn’t accept contributions to add new ecosystems .

Recently, I watched Viktor Farcic’s Automate Dependency Management With Renovate . I found Renovate super neat, thought about using it, and… forgot. Then I stumbled upon another mention of it. It pushed me to implement it in two locations:

Dependabot on foojay.io - Friends of OpenJDK

Using Bots to Keep Dependencies Updated

Renovate: Dependabot Alternative