Automate dependency update PRs

[perfectra1n]

How do we feel about using something to automate dependency update PRs? The two biggest tools that I can think of right now are Dependabot and Renovate. I believe it would help take a lot of the chore away from manually updating as needed (as we could just close the PR if we don't want to update the dep), and we could annotate the PR if the dependency update is related to security.

[eliandoran]

@perfectra1n , sure, we can give it a try. Do note that we are using fixed versions in package.json, because I wanted to ensure each dependency update is manually checked by someone (had a case where a package.lock JSON conflict caused a manual update of the file which broke the dragging of the application window due to a bug in Electron).

[perfectra1n]

Yeah, that's a solid usecase. We can of course just have the PRs trigger CI/CD to see if the container at least builds - but yeah we would need to manually review some PRs to see if the UI/Electron broke.

[perfectra1n]

I think that Renovate would be the best option for us then. We have two options for it - we could just run it as a daily cronjob as a GitHub Action, or we can use their GitHub app

Renovate allows for a ton of customization and tweaks. I've used it extensively :)

[meichthys]

I'm all for this, although I think it may be a good idea to have some basic automated tests in place first using a framework like Playwright.
This would ensure that at least the very basic functions like opening the app and navigating basic features are still functioning after these dependency updates.

[perfectra1n]

I don't think that should prevent us from using a tool to at least open PRs for updates, since we could checkout the branch and run our tests locally if there's a major/minor semver update. But yes, I fully agree that Playwright unit tests would be great.

[meichthys]

Ah I see. That makes sense. 👍

[eliandoran]

@perfectra1n is right. Either way, I tried Playwright and it seems nice but unfortunately I don't have the time to write or maintain the integration tests.