Blastoff Rails 2026 - Lightning Talk: Keep your Dependencies Fresh by Sam Williams

5, 4, 3, 2, 1. We have lift off. >> I actually met Sam at Blue Ridge Ruby. So, shout out to Blue Ridge Ruby. And let's give Sam a second to hook up before we give him the Blast Off Rails welcome. Yeah, good. Good. All right. Let's give him the warm Blast Off welcome in 5, 4, 3, 2, 1. >> Blast off! >> [applause] >> Uh hi, my name is Sam and I wanted to talk about the tool I use and love called Renovate. Um Here we go. So, I had a coworker tell me last year uh if something's hard, do it more often. And this really made me think of two things. I used to be a public school teacher uh in my first career and arguably I was pretty bad at it. Um calling parents was really hard and made me very anxious before I was going to do it. And so, doing it more and more, I got better at it and that anxiety kind of lessened as I went through. And the other thing it reminds me of is I used to hold my breath every time I ran bundle install uh because of this gem over here. So, Renovate's a bot and it scans your package files. It works with over 90 different package managers. It scans those files for your dependencies and it looks for updates for those dependencies and then it generates PRs in your repo so that you can merge those in. Out of the box, you get a dependency dashboard. It's just a high-level issue that shows you what's going on. Uh gives you links to those PRs. The PRs themselves, you get release notes from those dependencies, so you don't have to go to a different spot. Um it indicates vulnerability alerts and has some uh fast actions for those. It auto rebases your PRs, and it's free to run in a variety of different ways, and like GitHub, GitLab, get all those things. Um so if you're thinking this sounds a lot like uh Dependabot, I would say this sounds better than Dependabot. Uh so here's how I use it. Um so for smaller changes for dependencies, I just go ahead and auto merge those. I don't even look at those PRs. It will automatically just run your CI/CD, and then uh merge those uh independently with no human input. Uh if you're like me and like Ruby 4.0.0 comes out, you like wait a week because you know 4.0.1 with bug fixes is coming out in a few days. Um so you can actually delay the creation of those PRs for however long you want. Um and vulnerability alerts actually bypass this cuz you generally want to update those um quickly. My team likes to know on Monday what PRs we're going to deal with for these updates. So you can open these whenever you want. If your Fridays are free, you want to do them then, open them on Friday. Um if you use Aqua's uh Trivy security scan tool, you'll know that it got hit by a supply chain attack back in March. And the reason this happened is because um GitHub actions and Docker uh files use uh Git tags and Docker tags for pinning different versions. And those are mutable. And um what's not mutable or is immutable are digests. Um so Renovate swaps out those tags for digests, keeping you uh a lot less vulnerable to those supply chain attacks. You can also run uh tasks. You can run your own Python scripts uh or any sort of script. Um and this happens after uh the dependency is updated but before the PR is created. And what's nice about that, like in Git in GitHub, um if you have like a workflow that was going to do this, it won't actually trigger um like your pull request workflows afterwards cuz they want to stop from like circular workflows that never end. But it will trigger after Renovate updates, so you can run and keep files in in sync. Um if you have multiple like Ruby uh files where you indicate like the Ruby version for your application, Renovate you can group those. So when the PR gets generated, it updates all those different files. And you can pin uh private repos as well, which is really helpful. I use this a lot uh for my work. Um and so I wanted to talk a little bit about like the issue with having a private gem is like if you have multiple Rails apps um and you eventually realize, especially at work, like you realize they share some of the same code, you want to extract that code into a private gem or to a gem, you need to make it private because it's corporate IP. Um, and then you get into this weird case where like your different Rails apps are running different versions of that gem. Um, and that just becomes a nightmare to keep all up to date. Renovate just handles this. So, this is a workflow from a Ruby Gems dependency all the way to a deployed application through a private gem using Renovate using your CI/CD pipeline not touched by a human depending upon your configuration. Um, so if you're using Dependabot, I highly recommend you check out Renovate instead. Uh, my name is Sam Williams. So, thank you. >> [applause]