Post

i wrote a whole thing about wrangling npm dependencies because it's an unglamorous part of the job that's nevertheless really important. also because i wanted to make some watercolor illustrations. blog.val.town/gardening-de...

11 reposts70 likes

This is very good! I also think the ongoing task of keeping things updated probably deserves a mention. I’ve seen a lot of problems caused by automatic package update systems

You usually have to update things once in a while because vulnerabilities pop up. If you keep your dependencies to a reasonable level then you should have a good enough ratio of devs to dependencies for people to review incoming changes and apply updates intentionally

Would you say Renovate provides a better DX than Dependabot? Dependabot feels clunky at times but comes built in with GitHub. I’m curious to hear your opinion.

renovate has been a lot nicer for us - the dependency dashboard ticket is great and there's a ton of useful configuration possible, like running tasks after modules are updated

I just spent a whole afternoon pruning our npm dependencies. Your piece is super helpful. Excited to adopt some of your approaches. Thank you for sharing.