search

CycloneDX / cyclonedx-node-yarn

Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.
Apache License 2.0
21 stars 5 forks source link

[CHORE] keep packagemanager up to date #201

Closed jkowalleck closed 1 week ago

jkowalleck commented 3 weeks ago

this project has severaldependencies pinned to exact versions, some are unpinned. the version of yarn is also pinned - https://github.com/CycloneDX/cyclonedx-node-yarn/blob/61397bb10c0bc798d9480551628d38a6d0c1d52d/package.json#L150

some of our dependencies require s specific versions of yarn - for compat-patches andso.

when these dependencies are bumped, we might need to bump yarn, too.

we have dependabot in place, which bumps dependencies automatically okay-ish. Unfortunately, this tool does not upgrade the version of yarn.

lets find an automated solution for that.

jkowalleck commented 3 weeks ago

renovatebot seams to have this veature implemented:

will try it out

jkowalleck commented 1 week ago

renovate is working as expected