🆕 Dependabot Updates now syncs @types in TypeScript projects

[exvuma]

Dependabot will now keep your TypeScript project's @types dependencies in sync when updating packages. For example, if a project's package.json file lists jquery under "dependencies" and @types/jquery under "devDependencies", any PRs generated by Dependabot to update jquery will also update @types/jquery, if applicable.

For more details see the changelog.

Feedback Wanted!

Please let us know what you think in this thread 🤗 .

[thewilkybarkid]

Should PRs still be created if there isn't a matching @types version? PREreview/prereview.org#10 has been opened, updating http-errors from 1.8.1 to 2.0.0, but there's isn't yet @types/http-errors for 2.0 (DefinitelyTyped/DefinitelyTyped#58184).

[exvuma]

Yes, they should still get created even without the types update. Because an update on a package takes precedence over keeping @types perfectly aligned. For example, if there was a critical security vulnerably one would risk a minor break in the typescript type checker to secure their code. Do you agree? Or what situations would you expect Dependabot to wait for a types release to create a PR?

[thewilkybarkid]

The main problem is that there's nothing to say they're going to be misaligned. I've had another case today in PREreview/prereview.org#28: I deliberately didn't install that major version yesterday as there hasn't been a @types release for it. The build passes, so it's probably ok to merge, but I'm happy to wait in most cases. (Unless, as you mention, there are security reasons.)

An idea might be to have a message that the @types version is not aligned and a command to wait for it to be so (so a new PR will be created when they are both updated or something).

This should cover both sides of choosing to misalign and to wait. (As well as being a prompt that someone needs to go and update the @types. 😃)

[filiptammergard]

Brilliant update! We handled this manually before and it was often forgotten. Awesome to see Dependabot takes care of it automatically. Thanks!

[danepowell]

How does Dependabot handle @types/node? On my project which runs Node 14, Dependabot is trying to upgrade @types/node to 17.0.41, causing errors due to the Node version mismatch.

Can Dependabot infer node version from .nvmrc, package.json engines, or something else to keep the version in sync?

[Tridie2000]

You can tell Dependabot to ignore major/minor versions of packages:

version: 2
updates:
  - package-ecosystem: 'npm'
    directory: '/'
    schedule:
      interval: 'daily'
    open-pull-requests-limit: 1
    ignore:
      - dependency-name: '@types/node'
        update-types:
          - 'version-update:semver-major'
          - 'version-update:semver-minor'

[slifty]

+1 to the original question here -- we would like to avoid having to manually manage the versions of @types/node, and would like to instead be able to signal the node version using a .node-version (or .nvmrc) file. We tried specifying the "engines" in package.json but had no luck.

[blv-brunoneyra]

i believe package.json engines is more standardized and future-proof.
nvm may eventually be replaced by asdf, mise, devbox, devcontainers or the next thing.

[v3gard]

Awesome. Love the update!

Would it be possible to do something similar for other packages as well, and not just the type dependencies? This feature request has been open since August 7th 2019.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐