Enable Renovate in the 4.0-dev branch

[dgrammatiko]

@wilsonge you might want to enable renovatebot https://www.whitesourcesoftware.com/free-developer-tools/renovate/ (it's free for OSS projects) so that there are new PRs per npm/composer update. I propose to use the renovate instead of the debandabot as the first has more options and from my experience, it's a far better solution.

What will be the benefits of implementing this proposal?

• Nobody needs to track the updates of any dependencies
• you can automatically merge minor releases (if tests are passing, yeah I know there aren't enough tests to cover those cases, but maybe this could be a nice GSOC project: tests to cover all the npm/composer dependencies, or at least the ones used in the production)
• both package.json/composer.json as well as the package-lock.json/composer.lock are updated

I have no clue if the PT is reading any of this and if they need to agree on this but from a maintainer's perspective, this is a very helpful helper to have installed and configured in the main repo.

[dgrammatiko]

Here are the contents of a file named renovate.json (Could be on the.github of the repo, eg .github/renovate.json, so it doesn't polute the root...):

{
  "extends": [
    "config:base"
  ],
  "automerge": false,
  "major": {
    "automerge": false
  },
  "patch": {
    "automerge": false
  },
  "pin": {
    "automerge": false
  }
}

[HLeithner]

May I missed it, what's the benefit of renovate vs dependabot? Dependabot is owned by github right?

[dgrammatiko]

Here's an article https://dev.to/omaiboroda/try-to-update-your-dependencies-once-a-month-5dm5 that explains that renovate is way more flexible than dependabot. Both will do the same job but renovate creates PRs that (at least for me) are more approachable (overview of the changes in the release, etc)

[HLeithner]

Thanks will take a look