Automating the update of your dependencies

Now that we have an end-to-end workflow from our package repo into the release repo and, from there, into production, I want to show you how you can use dependabot together with GitHub Actions to automate the update process of your dependencies.

Getting ready…

In the repository, navigate to Settings | Code security and analysis and make sure that Dependency graph is enabled (see Figure 7.4):

Figure 7.5 – Enabling the dependency graph and optional dependabot alerts

This will analyze your repository and detect all dependencies that you can inspect under Insights | Dependency graph. You can also enable Dependabot alerts. In this case, dependabot will notify you when there are known vulnerabilities in one of your dependencies. Dependabot security updates go one step further, and dependabot will generate a pull request with a version update to a nonvulnerable version for you. To reduce the number...