@bubbles Ok, it’s always a good thing to not bring on too many dependencies obviously. I think rejecting the concept altogether is throwing the baby out with the bathwater. You just need to keep up with the updates instead of waiting until everything is out of date and it would take a ton of trouble to upgrade. There are tools like dependabot and renovate that help you keep up-to-date on your dependencies. Or you can even just run pnpm update —latest every once in a while. (Or its equivalent in whatever package manager you use).
bergie
Having used first greenkeeper and then dependabot in dozens of projects, they can indeed help a bit. But mostly by just spreading the workload across time. So if you do you weekly "check all dependency update PRs", then maybe your repo is ready to go the next time you want to do actual work on it. But honestly, even that weekly workload is a lot.
@bergie I guess I haven’t worked on any HUGE projects using these, so you may know more than I do. So far though my experience with renovate is that the hardest part is for someone to remember to click the approval button every so often otherwise the PRs back up.
Occasionally there is a major package upgrade that requires some code adjustments. And also there are sometimes some packages that fail pnpm’s trust requirements that require some examination.
Other than that I greatly prefer amortizing the effort over time than waiting for things to pile up.