n4r1b / ferrisetw

Basically a KrabsETW rip-off written in Rust
Other
65 stars 24 forks source link

Upgraded com dependency #43

Closed daladim closed 2 years ago

roblabla commented 2 years ago

It might be interesting to investigate if we can implement an action to update dependencies automatically in a safe way

I can highly recommend using dependabot for this. It automatically opens PRs whenever a dependency releases a new version. This makes it very easy to track updates. https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates#enabling-dependabot-version-updates

It's really easy to set up, all you have to do is commit a .github/dependabot.yml with the right contents, something like:

version: 2
updates:
  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "weekly"

will tell dependabot to check weekly for dependency updates, and open MRs for them (one MR per update to do). That MR will contain a simple bump to the Cargo.toml for that specific package.

daladim commented 2 years ago

Using dependabot on ferrisetw is a good idea, I'll have a look at it next week