Dependency management

[jdbruijn]

I've seen some really outdated versions of the dependencies used in this project. In #56 I see one update by Dependabot. Is Dependabot set up to provide dependency management for this project or was that just for one package/security related? I think it would be important to keep at least the dependencies up to date especially as this action is being used often.

I'm not familiar with Dependabot as I've been using Renovate so far. If noting is set up ATM, I'd be happy to help set up Renovate for automated dependency management, just let me know.

$ npm outdated
Package                          Current  Wanted  Latest  Location
@actions/core                      1.2.5   1.2.6   1.2.6  commitlint-github-action
@actions/github                    1.1.0   1.1.0   4.0.0  commitlint-github-action
@commitlint/config-angular         9.1.2   9.1.2  11.0.0  commitlint-github-action
@commitlint/config-conventional    9.1.2   9.1.2  11.0.0  commitlint-github-action
@commitlint/config-lerna-scopes    9.1.2   9.1.2  11.0.0  commitlint-github-action
@commitlint/config-patternplate    9.1.2   9.1.2  11.0.0  commitlint-github-action
@commitlint/format                 9.1.2   9.1.2  11.0.0  commitlint-github-action
@commitlint/lint                   9.1.2   9.1.2  11.0.0  commitlint-github-action
@commitlint/load                   9.1.2   9.1.2  11.0.0  commitlint-github-action
conventional-changelog-cli         2.1.0   2.1.1   2.1.1  commitlint-github-action
execa                              4.0.3   4.1.0   4.1.0  commitlint-github-action
husky                              3.1.0   3.1.0   4.3.0  commitlint-github-action
jest                              24.9.0  24.9.0  26.6.3  commitlint-github-action
prettier                          1.19.1  1.19.1   2.2.0  commitlint-github-action

[wagoid]

Is Dependabot set up to provide dependency management for this project or was that just for one package/security related?

Yeah, I was just worried about the security updates, not much worried about keeping everything on the bleeding edge. But I agree with you, since the action is being used often better to keep them up to date 🚀

Will have a look into it, thanks for the feedback!

[wagoid]

It looks like the config file added on PR #75 covers outdated deps too, according to dependabot docs for the basic config.

Will close the issue, but if we see dependabot is not working for package updates, feel free to reopen it or create a new one 👍