Why don't you set up automatic dependency updates?

[n-ce]

It seems a lot of time could be saved if the dependency updates are automatically merged.

[Bellisario]

Hi, thanks for asking!
I decided to not merge automatically dependency updates mostly because:

• some of the dependency updates actually change code built for the client, causing an update/reload message to every client, so I tend to group them together (I also left the "weekly" updates vs "daily" for this) and merge all of them in a small fraction of time to annoy the user the least possible
• other dependencies (ex. svelte-check) never (some rarely) changes client code, so they can instead be merged immediately
• I usually like to see the changes on the release notes for each dependency to check what's fixed/improved/added and manually test preview builds to check all is working as expected
• Last but not least, Dependabot team itself removed the built-in automerge feature because they were "concerned about auto-merge being used to quickly propagate a malicious package across the ecosystem": although I think the probability that a package used here could ever introduce malicious code is really low (also the "weekly" updates lowers it more), still I wouldn't trust 100% a full automatic merge affecting all clients

---

As a solution to the above issues, I could choose sometime to switch all the repo changes to a secondary branch used only for pre-release, redirecting all the pull requests and allowing auto-merge there.