Athunnea
Is there any good tool to track dependency updates for elixir apps on github?
For Ruby i used to use Gemnasium, it was very good. I can’t find anything like that for Elixir. I don’t like Dependabot because it automatically generates PRs for each dependency update, and there is no option to skip PR and just send a notification. Notifications is all i need
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Error tracking, logs, APM, uptime and cron monitoring in one dev-friendly platform. Find and fix problems before your users notice.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ai
- #ecto-query
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #metaprogramming
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 9- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
cnck1387
If you run
mix hex.outdatedit will show a list of dependencies, what version you have and the latest version available.Maybe you could rig a script to parse that on a schedule and send notifications out when current != latest. I could see something like that being doable with cron and ~100 lines of Bash.
OvermindDL1
Those PR’s are the notifications, how else would you expect to get them? It will even auto-close them if you update manually as well.
Athunnea
Of course you can run
mix hex.outdated. But when you have a few+ projects on github and you don’t touch them daily, you still want to know if dependency needs updating, especially for security reasonsAthunnea
Well, PRs are PRs, using them as notifications makes it look messy
Gemnasium used email notifications and a dashboard. It was quite informative and no noise in github PRs section. I wish there was something like that for Elixir
OvermindDL1
Considering they were all 7 days ago, I’m guessing the bot was just activated 7 days ago and those are the ones that are out of date. Should fix those. ^.^
If you close them, they stay closed. You can even tell the bot you don’t want to hear about further updates about a specific dep as well.
Huh?!? I’ve never seen such a section in github, what’s the github URL to such a thing?
Athunnea
This is from some public repo. It’s the reason I don’t use it, I don’t want my github to look like that. Besides i never update and deploy for each dep separately, so these PRs never get merged.
This is an old screenshot from Gemnasium, service that tracked ruby gems updates for your project. It was bought by Gitlab and closed. https://docs.gitlab.com/ee/user/project/import/gemnasium.html
Nothing like that for Elixir
LostKobrakai
They’ll all be closed once you update. No matter the amount of commits it took.
OvermindDL1
Precisely, and the bot keeps the PR updated with the latest commits as well, and will close it if you yourself manually update.
NobbZ
There once was
hexfaktorby @rrrene, which he took down quite a while ago for legal reasons. It wasn’t GDPR compliant, and as it seems taking it off was the easier way, than to fix compliance.https://github.com/hexfaktor/hex_faktor_web
Perhaps there is anything left in the repository you can use for you?
Another way might be to use GitHub actions
on: cron: …as soon as they are publicly available or if you are already in beta, to runmix hex.outdatedon a regular basis.If you decide to do so, it would be nice to support hexpm/hex#714 and explain your usecase and how you would benefit from an output that is easier parsable than an aligned table.