Awilix 7.x

[davidzwa]

Hi there, congrats with the new major on awilix!

Would love to upgrade awilix with awilix-express etc. Thanks in advance for your awesome work 🥳

[jeffijoe]

Oops, I forgot 😅

Done now, v7 is out.

[davidzwa]

Awesome job! Did you know, a bot like renovate and whitesource can trigger PR's for this automagically. Really helps me out so far with external packages as well as my self-maintained dependencies.

https://github.com/fdm-monster/fdm-monster/blob/develop/renovate.json I can help you set it up if you want

[jeffijoe]

I don't have automatic releases for awilix-express and I am also not sure if its possible to make sure that the awilix-express package follows the same major version as awilix?

[davidzwa]

As awilix is in your peerDependencies renovate would detect any awilix update and create the PR which would notify you and make you aware that a release is in order. You could automatically let this merge but the idea is that it reminds you "hey a release is in order".

Another big advantage of renovate is that it tracks any package with possible vulnerabilities, or any update whatsoever! You can customize this to batch up package updates together on for example a weekly basis as well. I am convinced so far that Whitesource Renovate does this better than Dependabot.

Here is my repository which - when published to NPM - triggers my main repo fdm-monster to update the client dependency with a PR. https://github.com/fdm-monster/fdm-monster-client And this is how such a PR would look like: https://github.com/fdm-monster/fdm-monster/pull/215

What do you think, shall we give it a shot?

[jeffijoe]

I do use semantic-release on awilix-koa so any PR that gets merged over there will trigger a release, so ideally I would like it set up so that when it detects a major version bump for Awilix specifically that it'll create a PR with a commit description similar to what I did here.

Since most of my libraries' dependencies don't rely on anything beyond tslib and my other packages (which depend on the same things), I don't really care much about other packages being updated until I need to work on them again.

[davidzwa]

https://docs.renovatebot.com/configuration-options/#matchpackagenames

I think the matchpackagenames allows us to configure it so we only have awilix being tracked.

Renovate requires:

• renovate.json (see here, copy and adjust)
• user/org Renovate app authorization
• add strict filter

If I hear you correctly the semantic-release would cause automatic releases. Not sure if that's a 100% good idea as I'd always like to see a "human pushing the button", but that's of course entirely up to you.

[jeffijoe]

The human would be the person hitting the merge button, so would have to set it up to not auto-merge.

I think I'll hold off on this for now. I would have found out eventually myself once upgrading my own projects failed due to the missing update on the awilix-koa side. Thanks though!

[davidzwa]

No problem, I will ping you with a PR/issue as I've done before if that's no problem as I really like this project and would love to stay on top of updates 💪🏼