Keep your dependencies in check
summary
Compares automation and migration tools and gives concrete tradeoffs: Dependabot (GitHub-native alerts plus security/version PRs), Renovate (more fine‑grained config, adoption/confidence metrics on updates), Snyk (bundles related PRs, PR checks for incoming vulnerabilities). Describes implementing the bots on GitHub, shows noisy initial PR spikes, and reports a real rollback when integration tests stopped running after a dependency update. Mentions automated refactoring tools like OpenRewrite and refaster-based fixes and JetBrains’ built‑in migrations for common Java moves.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:23VULNERABILITIES
- 4:14Selecting dependencies
- 7:46Dependency information
- 10:46Maintain dependencies
- 14:17IntelliJ IDEA: Ultimate Edition
- 15:06Software Composition Analysis (SCA)
- 17:43Dependabot security updates
- 18:00Dependabot version updates
- 19:10Renovate enable
- 19:38Renovate configuration
- 20:43Renovate Dashboard
- 23:13Snyk Open Source Configuration
- 23:41Bots: Pros & Cons
- 25:10Migration tools
- 27:28OpenRewrite
- 29:20Quickstart: Maven and Gradle
- 31:04Conclusion
- 31:37Slides
related talks
31mKeep your dependencies in check
37mKeep Your Dependencies in Check
31mRenovate/Dependabot: How to Take Back Control of Dependency Updates
47mTales from the Dev Side: What Went Wrong, What We Fixe & What You Can Steal
45mHow to Automate Dependency Updates with the Renovate@Roche Bot
29mDependency Management: Where the Fork are We?
31mStrengthen Our Developer eXperience to Face Obsolescence and View...- 45mHow to Automate Dependency Updates with the Renovate@Roche Bot