chore: add Dependabot config for automated dependency updates

Open Beginner friendly
#2,321 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Quiet
Tech stack
github-actions, javascript
Domain
ci-cd, devops

Research direction

Create .github/dependabot.yml using the four npm package directories listed in the issue; first inspect the repository’s package layout and existing GitHub Actions workflow files. Ensure /packages/web, /packages/vue, /packages/native, and /packages/reactivecore receive weekly updates, and update checkout/setup-node references from v2 to v4 where applicable. Done means all four packages are covered and the YAML validates.

Written by the indexing model from the issue text.

Description

Problem

The monorepo has no automated dependency management. Several packages are critically outdated:

  • Babel v6 (babel-cli@^6.26.0, babel-preset-env@^1.6.1) — EOL since 2019, no nullish coalescing/optional chaining
  • Jest v22 (jest@^22.4.2) — 2018 release, missing modern features
  • Downshift v1.x (downshift@^1.31.2) — current stable is v9, missing 7 years of a11y fixes
  • Webpack v4 (webpack@^4.18.0) — v5 has been stable since 2020
  • Emotion v10 (@emotion/core@^10.0.28) — v11 is current (Vue package already uses v11)

Suggested Fix

Add .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: 'npm'
    directory: '/packages/web'
    schedule:
      interval: 'weekly'
  - package-ecosystem: 'npm'
    directory: '/packages/vue'
    schedule:
      interval: 'weekly'
  - package-ecosystem: 'npm'
    directory: '/packages/native'
    schedule:
      interval: 'weekly'
  - package-ecosystem: 'npm'
    directory: '/packages/reactivecore'
    schedule:
      interval: 'weekly'

Also recommend upgrading to actions/checkout@v4 and actions/setup-node@v4 (current is v2).

Severity

Medium — long-term maintenance burden

Dominant language
JavaScript
Stars
4.9k
Forks
477
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from appbaseio/reactivesearch

All issues in appbaseio/reactivesearch

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.