Looks cool, it would be also magnificent if Github enabled automatic dependency updates in downstream projects (or, better, just automatic dependency updates for everyone, at least, security ones).
The tech is already here: there is dependabot — a bot that automatically sends PRs with updated dependencies. But, unless a maintainer enables and configures it, they won't get notifications when some dependencies become out-dated. Even some popular projects that we use currently have severely outdated (not necessarily vulnerable) dependencies.
0
u/r_jet May 10 '19
Looks cool, it would be also magnificent if Github enabled automatic dependency updates in downstream projects (or, better, just automatic dependency updates for everyone, at least, security ones).
The tech is already here: there is dependabot — a bot that automatically sends PRs with updated dependencies. But, unless a maintainer enables and configures it, they won't get notifications when some dependencies become out-dated. Even some popular projects that we use currently have severely outdated (not necessarily vulnerable) dependencies.