Lerna support

[greysteil]

Currently, Dependabot supports monorepos that use Yarn workspaces, and those that add Dependabot manually for each package. This PR is intended to improve monorepo support further by using the information in a lerna.json file to automatically update all package.json and lockfile files in a monorepo at once. (I.e., it extends the current behaviour we use for Yarn workspaces to work for repos with a lerna.json file.)

TODO:

• Fetch lockfiles as well as package.json files
• Update FileParser to handle multiple packages at once
• Update UpdateChecker to handle multiple packages at once (this should just work)
• Update FileUpdater to handle multiple packages at once

[imhoffd]

@greysteil Does this build on an underlying grouping mechanism that would be used in https://github.com/dependabot/feedback/issues/5? 😄

[greysteil]

@dwieeb - sadly not - that's going to be a separate job. This just reads a lerna.json and figures out which additional files to pull down and update. Been meaning to get it finished for ages!

[imhoffd]

I'm excited for lerna support regardless! 🎉

[greysteil]

Deployed, and working well in testing. @dwieeb - if you give it a go let me know. If you add Dependabot at the root of a repo with Lerna it will automatically detect all of the package.json files (and any lockfiles) and create PRs that bump all of them at once (for a given dependency).

[imhoffd]

@greysteil Sorry for taking forever to get back to you. It seems to be working well, although I think globbing may be slightly inaccurate. (let me know if I should create an issue instead)

Take a look at the integration in https://github.com/ionic-team/ionic-cli

We use the following config for our lerna packages:

  "packages": [
    "packages/**"
  ],

lerna ls:

@ionic/cli-framework  v1.3.0
@ionic/discover       v1.0.7
@ionic/lab           v1.0.13
@ionic/utils-fs       v0.0.4
@ionic/utils-network  v0.0.4
@ionic/v1-toolkit    v1.0.12
cli-scripts          v0.0.22 (private)
ionic                 v4.3.1

But the dependabot language at the root of the repo only lists the packages as if the glob were packages/*: