Dependency management

[vasco-santos]

State of the Art

web3.storage dependencies versioning is currently controlled by the package-lock.json. In this kind of project having the guarantees provided by the package-lock is important.

We currently maintain the web3.storage dependency updates manually, basically each time we add a new dependency, or want to update a given dependency because we know that it will bring needed functionality or fixes in.

This approach has a few problems:

• no easy way of tracking dependency updates
  • we might miss important security/performance patches from dependencies we do not own/track
• needs proactive manual updates regularly
• might delay identifying dependency

On the other side of the spectrum, we do not have any noise from automation, which in a super active project can easily be annoying and distractive.

Potential Solutions

1. Setup renovate
2. Weekly task to get all dependencies updated
3. ...

1. Renovate

renovate can be configured so that it minimizes noise during active development. For instance, we can define a schedule for weekend updates.

While we can setup automerge, we will still need human interaction when CI stops working.

For who watches the repo, there will still be notifications, but we also have them for release bot. Considering we make them outside weekdays should be a good compromise.

In comparison with the well known dependabot, despite being similar, renovate has extra benefits including:

• nice support for monorepos where a single PR can update the same dependency in multiple packages
  • meaning way less PRs for updating dependencies like ipfs-car, which is shared among several packages
• custom configuration for automerge based on rules allowing a fine-grained control over merge or let human see it

2. Weekly Task

The less noisy and simple approach would be to have someone update every dependency each week. This will need more manual work and management to guarantee we are consistent in doing this.

This can be part of the on call duties to easily distribute the load.

Conclusions

Renovate seems to make sense and avoid a lot of our main concerns (noise and distractions). I think we should give it a try and see if it suits our needs.

[olizilla]

@vasco-santos can you compare renovate with the flow we'd get if we use the built in dependabot feature in github, please.

[vasco-santos]

Sure, I looked into that too. I did not include it because we are using a monorepo where renovate shines in comparison. But I will add it to the original post