Dependabot and other dependency update tools

What are auto dependency update tools?

Automatic Dependancy update tools are used to monitor your dependencies, by checking the semantic versioning of your dependencies and when a new release is available a PR is automatically made with the updated version number for the dependency.

A popular one to use is Dependabot. This is Github’s own dependency updater but there are a few more out there you can try out including snyk and Renovate. Snyk has a product Snyk Open Source that focuses on security and ensuring your code isn’t vulnerable. Renovate is a tool made by mend to help keep your dependencies updated. All these tools work across multiple languages so all your code can stay up-to-date.

Why use auto dependency update tools?

There’s many pros to using an auto dependency update tool. One of the main ones is security. Older dependencies can contain vulnerabilities so by ensuring you always have the latest release of your dependencies this reduces the risk of having vulnerabilities in your code. It also just makes staying up-to-date a whole lot easier and reduces your time spent on updating dependencies.

How can I use dependency update tools?

Each tool will have a slightly different way to set up but they will work with your Github repository. Dependabot is the easiest to set up as it is only a few clicks in your repo settings so you can have it enabled in no time. You can find how to enable it in the Github docs.

You can also use alongside these tools, an auto merging tool like mergify so that the whole process of updating your dependencies is automated.

So when using any of our products you can now stay up-to-date and ensure that you get to utilise all the exciting new features as soon as they are released.