Skip to main content

Dependency updates

Eddy includes a Renovate configuration, renovate.json, that keeps the npm packages in package.json, and the GitHub Actions and Docker images in .github/workflows/*.yml, up to date. Install the Renovate GitHub app on your repository to turn it on.

What it does​

  • Minor and patch updates share 1 pull request on the deps/all branch, and major GitHub Actions updates share another on deps/major-all.
  • Pull requests merge on their own once their checks pass. Renovate hands the merge to GitHub's auto-merge, which waits only for the checks that branch protection requires, so set that up before you rely on it.
  • GitHub Actions and Docker images are pinned to SHA digests.
  • Version ranges in package.json are bumped to the latest version, such as ^1.2 to ^1.3.
  • A Dependency Dashboard issue tracks pending updates, approval requests and detected problems.

What it leaves to you​

Renovate leaves Composer packages and major npm versions alone. Update the dependencies in composer.json by hand, to keep them compatible with Drupal.org packaging, and apply major npm updates by hand too. Every build resolves the composer.dev.json ranges to their newest releases anyway (see How versions are resolved).

See the Renovate documentation for every option.