Up-to-date dependencies are vital in software development. Learn how Renovate automatically updates your dependencies in CI/CD environments using Renovate.

This article addresses an important issue in software development projects: keeping dependencies up to date. Updating dependencies closes potential security vulnerabilities and allows us to use recent features and apply bug fixes. Here, I demonstrate an approach to update dependencies automatically in CI/CD environments using Renovate.

What problem does Renovate tackle?

Take a look into your package-lock.json or yarn.lock files and you’ll surely notice you’re dealing with hundreds if not thousands of dependencies every day. Dependencies cause problems sooner or later:

• Maintenance efforts increase over time due to breaking changes, major updates, etc.
• At some point, it may no longer be feasible to keep projects updated simply because so many dependency updates pop up on a daily basis
• Security vulnerabilities become more likely

So on the one hand, you should update dependencies to more recent versions to utilize new features, benefit from performance improvements, or close security gaps. On the other, updating dependencies is a tedious task that consumes a lot of your team’s time and delays their work on improving your product and building new features.

You normally benefit from timely updates that involve only small version jumps because chances are good that updating does not break your build. Waiting too long means your team has to spend a lot of effort to perform bulk updates, especially if major updates are involved.

If you update many dependencies at once, you might have the following problems:

• Your build is broken — which dependency is to blame?
• Your build is OK, you’ve merged all dependencies, but your deployment is broken — which dependency caused it?

It’s fair to say that it is not sustainable to perform these manual dependency updates periodically. You need tool support — thank goodness there’s Renovate!

#renovate #developer