<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap:break-word"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">I love this, thank you! (for the record, I worked with James at the Open Data Institute on Bimble)</div> <div><br></div>We’ve had it running with some of the ODI gems, and it’s a tad noisy to get PRs on a daily basis. Could there be an option to do it weekly? When I was at the ODI, this is what we did with Bimble, and this meant we had some time scheduled to review all the updates, check the tests passed and merge.<div><br></div><div>I’ve also noticed that it seems to default to only one organisation, and I can’t seem to work out how to manage personal repos or any other orgs?</div><div><br></div><div>Other than that, it looks awesome! :)</div><div> <div id="bloop_sign_1496219217367667968" class="bloop_sign"></div> <br><p class="airmail_on">On 30 May 2017 at 21:11:00, Mark Burns (<a href="mailto:markthedeveloper@gmail.com">markthedeveloper@gmail.com</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<title></title>
I think if I used this, I'd like the option to update dependencies
of dependencies. Otherwise, you may have a false sense of security.
Other tools would still flag them leaving it as a manual
step.<br>
<br>
Perhaps the dependency chain to your app's dependencies could be
highlighted in the PR description. The title could also be
different to make it less confusing.<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, 30 May 2017 at 23:48, Harry Marr
<<a href="mailto:harry.marr@gmail.com">harry.marr@gmail.com</a>>
wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div>Thanks James, I'm glad you find it useful!</div>
<div><br></div>
<div>So far we've deferred doing anything with git dependencies
(including those specified in the Gemfile), but we're very aware
we'll need to tackle them at some point! Handling dependencies that
specify a tag would be tough - everyone uses different tagging
schemes, and just using the most recently created could be
dangerous - but dealing with branches should be relatively
easy.</div>
</div>
<div dir="ltr">
<div><br>
<div class="gmail_quote">
<div>On Tue, 30 May 2017 at 14:32, James Smith <<a href="mailto:james@floppy.org.uk" target="_blank">james@floppy.org.uk</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div id="m_8567237508203902774m_4852131179407009737m_-4822114200331305581bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
Harry, </div>
<div id="m_8567237508203902774m_4852131179407009737m_-4822114200331305581bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
<br></div>
<div id="m_8567237508203902774m_4852131179407009737m_-4822114200331305581bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
This is bloody brilliant, thankyou. We wrote something similar at
the Open Data Institute to do dependencies for us (<a href="https://github.com/theodi/bimble" target="_blank">https://github.com/theodi/bimble</a>), and always meant to
turn it into a proper SaaS thing, but never got time. Thankyou for
doing it so we don’t have to :)</div>
<div id="m_8567237508203902774m_4852131179407009737m_-4822114200331305581bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
<br></div>
<div id="m_8567237508203902774m_4852131179407009737m_-4822114200331305581bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
I’ll give you bonus points if you can do git submodules too
:)</div>
<br>
<div class="m_8567237508203902774m_4852131179407009737m_-4822114200331305581bloop_sign" id="m_8567237508203902774m_4852131179407009737m_-4822114200331305581bloop_sign_1496151036463767040">
<div style="font-family:helvetica,arial;font-size:13px">
cheers,<br>
James Smith<br></div>
</div>
</div>
<div style="word-wrap:break-word"><br>
<p class="m_8567237508203902774m_4852131179407009737m_-4822114200331305581airmail_on">
On 30 May 2017 at 14:08:31, Harry Marr (<a href="mailto:harry.marr@gmail.com" target="_blank">harry.marr@gmail.com</a>) wrote:</p>
</div>
<div style="word-wrap:break-word">
<blockquote type="cite" class="m_8567237508203902774m_4852131179407009737m_-4822114200331305581clean_bq">
<div>
<div>
<div><span><span style="font-size:12.8px">El Rug,
hola!</span></span>
<div style="font-size:12.8px"><br></div>
<div style="font-size:12.8px">A friend and I just
released <a href="https://dependabot.com/" target="_blank">Dependabot</a>, a tool (built in Ruby) for automatically
keeping Ruby & JS dependencies up-to-date. We'd love any
feedback -- does this match your ideal flow for keeping your
Gemfile{,.lock} up-to-date? If not, what would you like to see it
do differently?</div>
<div style="font-size:12.8px"><br></div>
<div style="font-size:12.8px">Currently it'll run each morning and
create a GitHub PR for each dependency that needs bumping. We've
seen other tools that submit one big PR for all updates, but we
found those PRs much harder to review, and much risker to merge.
That said, more PRs is a bit noisier, so there is a tradeoff.</div>
<div style="font-size:12.8px"><br></div>
<div style="font-size:12.8px">Another thing to note: we won't
proactively bump sub-dependencies - they only get bumped when the
top-level dependency gets updated (e.g. <i>arel</i> will
only get updated
when <i>activerecord</i> or <i>rails</i> gets
updated). I'd particularly like to hear thoughts on this one. If we
did bump sub-dependencies, the volume of PRs would dramatically
increase, and could be quite confusing ("what's loofah?! oh, a
sub-sub-dependency of rails...."). However, not bumping means we
could miss out on important patches.</div>
<div style="font-size:12.8px"><br></div>
<div style="font-size:12.8px">We also wrote up a few blog posts
explaining:</div>
<div style="font-size:12.8px">
<ul>
<li style="margin-left:15px"><a href="https://dependabot.com/blog/introducing-dependabot" target="_blank">what Dependabot is</a>,</li>
<li style="margin-left:15px"><a href="https://dependabot.com/blog/why-bother" target="_blank">why we
think staying up-to-date is worthwhile</a>,</li>
<li style="margin-left:15px">and <a href="https://dependabot.com/blog/the-latest-dependency-version-is-probably-the-most-secure" target="_blank">the impact of staying up-to-date on responding to
security issues</a><br></li>
</ul>
</div>
<div style="font-size:12.8px">Look forward to hearing your
thoughts!</div>
<div style="font-size:12.8px"><br></div>
<div style="font-size:12.8px">Harry</div>
<div class="m_8567237508203902774m_4852131179407009737m_-4822114200331305581gmail-yj6qo m_8567237508203902774m_4852131179407009737m_-4822114200331305581gmail-ajU" style="margin:2px 0px 0px;font-size:12.8px"></div>
</div>
</div>
</div>
</blockquote>
</div>
<div style="word-wrap:break-word">
<blockquote type="cite" class="m_8567237508203902774m_4852131179407009737m_-4822114200331305581clean_bq">
<div>
<div><span>_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a><br>
Archives: <a href="http://lists.lrug.org/pipermail/chat-lrug.org" target="_blank">http://lists.lrug.org/pipermail/chat-lrug.org</a><br>
Manage your subscription: <a href="http://lists.lrug.org/options.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/options.cgi/chat-lrug.org</a><br>
List info: <a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br></span></div>
</div>
</blockquote>
</div>
_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a><br>
Archives: <a href="http://lists.lrug.org/pipermail/chat-lrug.org" rel="noreferrer" target="_blank">http://lists.lrug.org/pipermail/chat-lrug.org</a><br>
Manage your subscription: <a href="http://lists.lrug.org/options.cgi/chat-lrug.org" rel="noreferrer" target="_blank">http://lists.lrug.org/options.cgi/chat-lrug.org</a><br>
List info: <a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" rel="noreferrer" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br></blockquote>
</div>
</div>
</div>
_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a><br>
Archives: <a href="http://lists.lrug.org/pipermail/chat-lrug.org" rel="noreferrer" target="_blank">http://lists.lrug.org/pipermail/chat-lrug.org</a><br>
Manage your subscription: <a href="http://lists.lrug.org/options.cgi/chat-lrug.org" rel="noreferrer" target="_blank">http://lists.lrug.org/options.cgi/chat-lrug.org</a><br>
List info: <a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" rel="noreferrer" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br></blockquote>
</div>
_______________________________________________
<br>Chat mailing list
<br><a href="mailto:Chat@lists.lrug.org">Chat@lists.lrug.org</a>
<br>Archives: <a href="http://lists.lrug.org/pipermail/chat-lrug.org">http://lists.lrug.org/pipermail/chat-lrug.org</a>
<br>Manage your subscription: <a href="http://lists.lrug.org/options.cgi/chat-lrug.org">http://lists.lrug.org/options.cgi/chat-lrug.org</a>
<br>List info: <a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a>
<br></div></div></span></blockquote></div></body></html>