Automate your node dependency updates
Tags: javascript, npm, github, productivity
Published: 2019-07-21 08:36:26

A reasonably large Node application will have 100's of dependencies. Keeping them all updated is a 🧹chore a developer needs to perform at some point. Either you ignore the dependency updates until you are stuck with a very old set of dependencies hindering your progress with 🦹‍♂️ security vulnerabilities or you spend your valuable application development time manually testing out the updates on a reasonable cadence.

Let's see how to automate this process in an enterprise environment assuming you have some kind of CI/CD environment and a private GitHub repo.

## 🥒 Ingredients

1. Solid unit tests for your code. Bonus points if you have end to end tests and snapshot tests for UI components
1. `next-update`
_An npm package which tests whether your dependencies can be updated without breaking the tests._
1. `hub` CLI
    _This is a command-line application from Git"Hub" which can interact with your GitHub repo. `hub` is exactly similar to `git` CLI and a drop-in replacement but has added features to interact with GitHub. Handy to open a Pull Request after the update operation._

## 📝 Recipe
* `npm install next-update --save-dev`
   _Install next-update as a dev-dependency._

* Configure an `npm` script `dep:update` in your `package.json` scripts section
 

    ```js
    // package.json
    {
      "name": "a-sample-node-project",
      "version": "0.0.1",
      "description": "A sample node project",
      "scripts": {
        "test": "jest",
        "start": "node app.js",
        "dep:update": "next-update" // Configure an npm script
      },
      "devDependencies": {
        "next-update": "^3.6.0"
      },
      "dependencies": {
      },
    }
  ```
* `npm run dep:update`
    _Run the script. `next-update` will go ahead and find all new packages. Updates them in sequence and keep the update if your tests pass._

* Download and install the `hub` cli
    ```sh
    # download-hub.sh
    HUB_CLI=/opt/hub-linux/bin/hub

    if [[ ! -f $HUB_CLI ]]; then
       wget https://github.com/github/hub/releases/download/v2.12.2/hub-linux-amd64-2.12.2.tgz 
       tar zxvf hub-linux-amd64-2.12.2.tgz 
       rm -rf hub-linux-amd64-2.12.2.tgz /opt/hub-linux
       mv hub-linux-amd64-2.12.2 /opt/hub-linux
    fi
  ```

* Configure hub
    ```sh
    git config --global --replace-all hub.host github.yourdomain.com
    git config --global --replace-all hub.protocol git
  ```

* Instruct the 🤖 bot to open a Pull Request
    ```sh
    $HUB_CLI add package.json package-lock.json
    $HUB_CLI commit -m "🤖 [BOT] Automated dependency update"
    $HUB_CLI pull-request \
        --push \
        -m "Pull Request Subject" \
        -m "Pull Request Description" \
        --no-edit \
        --reviewer user-id1,user-id2
  ```
* Hook up this script in your CI/CD environment to run daily

<img src="https://thepracticaldev.s3.amazonaws.com/i/3re3uynhyg0kc4jpw7hx.png" width="50%"/>

## Wrapping up

We saw how to check and update the node dependencies and automate the process of opening a PR. If your project is open-source, you may use a service like Greenkeeper.  

Cheers

<img src="https://thepracticaldev.s3.amazonaws.com/i/src9sniteiq1jdvbxg1z.png" width="25%"/>

Please find my previous writings on Medium:

1. [One side rounded rectangle using SVG](https://medium.com/@dennismphil/one-side-rounded-rectangle-using-svg-fb31cf318d90) 
1. [Visual Studio Code — Debug Mode](https://medium.com/@dennismphil/debugging-node-js-using-visual-studio-code-c30e5eeb9e38)
1. [I want TypeScript to succeed.](https://medium.com/@dennismphil/i-want-typescript-to-succeed-d421d00fd856)
1. [What’s in my laptop?](https://medium.com/@dennismphil/whats-on-my-laptop-2cc2619aa55f)
1. [CoffeeScript’s most loved feature soon in JavaScript](https://medium.com/@dennismphil/coffeescripts-most-loved-feature-soon-in-javascript-b2f6740c2dc7)