Dependencies - Tag - vo.rs

Renovate Bot: Automated Dependency Updates That Don't Break Everything

Sat, 07 Feb 2026 10:00:00 +0000

I have a confession that every honest engineer shares: I do not update my dependencies often enough. Things work, the backlog is long, and the moment you bump one library you discover three transitive ones that hate you now. So packages rot, CVEs accumulate, and then one terrible Tuesday you attempt a major upgrade across two years of drift and lose an afternoon to it. Renovate exists to stop that slow-motion disaster by turning one enormous painful upgrade into a steady stream of tiny, reviewable ones.

SBOM: Software Bill of Materials and Why You Should Care About Your Dependencies

Fri, 21 Nov 2025 07:00:00 +0000

Every time a serious supply-chain vulnerability lands, the same scramble begins. Someone in a chat channel asks “are we affected?” and the honest answer, for most teams, is “give us a few days and we’ll tell you.” That few days is the gap an SBOM is meant to close. A Software Bill of Materials is just an inventory — a machine-readable list of every component that went into a build — but having one ready before the panic is the difference between an afternoon and a fortnight.