Automating my dependency management workflow
Tags: github, dependencies, automation, opensauced
Published: 2019-08-23 15:11:55

---
title: Automating my dependency management workflow

published: true
description: 
tags: github, dependencies, automation, opensauced
---
Maintaining version management can be challenging when the desire for innovation and growth of the project gets in the way. Last year, GitHub announced their migration from [Rails 3.2 to 5](https://github.blog/2018-09-28-upgrading-github-from-rails-3-2-to-5-2/). As mentioned in that post, this was no small task and required a dedicated resource to manage. This Rails upgrade took a year and a half, and the Rails Core team has made a lot of improvements around making the update more approachable.


[![blog-header-link](https://user-images.githubusercontent.com/5713670/63602515-23b0ff00-c5b7-11e9-8f28-bb68c259c8a7.png)](https://github.blog/2018-09-28-upgrading-github-from-rails-3-2-to-5-2/)


My recent migration story started by enabling the [Dependabot Preview](https://github.com/marketplace/dependabot-preview) on one of my repositories. Through notifications from the feature I discovered despite my best effort in leveraging the latest and greatest open-source tools, I failed to stay up to date with Webpack versions. Webpack had a major version upgrade from 1 to 2 back when I started my project, and similar to the Rails migration from 3.2, the path for upgrading was challenging. I knew this first-hand because I migrated my work repository over around the same time this project initiated. 

[Webpack](https://webpack.js.org/) today is now thriving and currently on version 4 with [automated migration path](https://webpack.js.org/migrate/4/) via the CLI. Thanks to Dependabot’s discovery on this oversight through a computerized pull request and my existing Continuous Integration I could get started. In every Dependabot Pull Request release notes and changelog to help the maintainer with the QA review process. 

For those who are unaware of Webpack is a static module bundler for modern JavaScript applications. A bundler Webpack bundle is leveraged during development or production build process. The vulnerability I alerted for indicated an [issue](https://github.com/nodejs/security-wg/blob/master/vuln/npm/485.json#L4) where attackers can steal developer's code because the WebSocket server does not check the origin of requests. 


![pull request dependabot example](https://user-images.githubusercontent.com/5713670/63602642-7094d580-c5b7-11e9-8c83-fe71170e77f8.png)


Thanks to this alert and the [Webpack migration-CLI tool](https://webpack.js.org/migrate/4/) I was able to upgrade from Webpack version 1 to 4 in a Saturday evening.  I was happy to get this alert and subsequent alerts after notifying me of opportunities to keep my project up to date and absent of vulnerabilities. 

I have since managed to upgrade several other dependencies in this same project and plan to continue leveraging the latest versions here on out thanks to Dependabot. If you have a project that you or others care about, consider enabling Dependabot on your project today so you can get a notification when your project needs maintenance. 

[![dependabot preview image](https://user-images.githubusercontent.com/5713670/63602654-7ab6d400-c5b7-11e9-8ef3-77d8bfe45324.png)](https://github.com/marketplace/dependabot-preview)