Managing dependencies

Why do we need to update regularly?

• Recent dependency versions will have new features we might be looking for.
• Known bugs/issues (including security) are likely to be fixed.
• It prevents us from building our applications on top of outdated APIs.
• It makes updates smoother.

We follow these rules:

Updating interval

We update dependencies at the beginning of every month. This allows us to make smaller steps between versions. If switching to the new version is hardly possible we might postpone updating that single dependency to the next month.

Choosing dependency version

Prefer latest stable versions from official sources. Use unreleased version only if necessary (e.g. it has features/fixes which are needed).

Evaluate changes

When updating dependencies (especially major versions) always check repository page. It will likely introduce newest features and breaking changes. If dependency throws you an error, you might find other developers already having that error posted into the issues page. In case it is empty and you are not finding anything on google, it is likely that your code is what causes that error.

Forking dependencies

Prefer to avoid forking dependencies. Always check existing forks/issues first. If your problem does not seem to be resolved yet then follow these steps:

• Make a public fork from project’s GitHub page using necolt account.
• Do a proper pull request to upstream.
• Use your fork until your pull request is accepted and released.
• Rebase your fork monthly until it is released.
• Switch to official version when released.