1
0 Comments

Is this a good idea - preemptively update package.json dependencies to discover breaking changes before they surprise you

This is just a thought bubble, so not fully fleshed out. But thought I'd post here regardless to see if it has legs.

Problem:

The JavaScript / npm ecosystem is a mess.

Sometimes packages will import their own dependencies transitively, which have specific package version requirements that conflict with your own.
Sometimes a package update won't work with your version of node.
Sometimes a node update version will render your package or a dependency unusable.

Most of these issues are resolvable but require a lot of troubleshooting and intervention that is time-consuming and a distraction.
Often you don't discover that you need to do this troubleshooting until you are already in the middle of an unrelated task, which you have probably already estimated and committed to assuming that the npm ecosystem wouldn't cause any trouble.

Solution:

A service that monitors your codebase/repo, proactively increments the version of each dependency and tries to build and test the project with the updated package. If it succeeds, you get an automated pull request for your approval (allowing you to current with the latest supported releases of your dependencies).
If it fails, you get a notification and can decide if you want to
a) stay on your current version until it's no longer supported
b) schedule the effort to upgrade that dependence somewhere in your backlog.

Because it's proactively monitoring your repo in the background, this gives you the opportunity to schedule work in upcoming sprints rather than being derailed mid-sprint.

Snyk.io would be the closing thing I can think of in terms of mechanics, though Snyk is monitoring dependencies for security issues not build issues, and doesn't actually build your project.

--
If you're a JavaScript developer, would this be useful to you?

on February 28, 2023