WARNING: THIS SITE IS A MIRROR OF GITHUB.COM / IT CANNOT LOGIN OR REGISTER ACCOUNTS / THE CONTENTS ARE PROVIDED AS-IS / THIS SITE ASSUMES NO RESPONSIBILITY FOR ANY DISPLAYED CONTENT OR LINKS / IF YOU FOUND SOMETHING MAY NOT GOOD FOR EVERYONE, CONTACT ADMIN AT ilovescratch@foxmail.com
Skip to content
This repository was archived by the owner on Dec 10, 2025. It is now read-only.

Conversation

@dacharyc
Copy link
Collaborator

This PR adds a new Go CLI we can use to check monorepo project dependencies. It currently supports the following types of dependency files:

  • .csproj (used in C# Driver project)
  • go.mod (used in Go test projects)
  • package.json (used in JavaScript Driver, MongoDB Shell, OpenAPI test projects)
  • pom.xml (used in Java Driver projects)
  • requirements.txt (used in PyMongo project)

It uses the native tooling for each of these dependency file types to check for updates, and has distinct commands to do one of:

  • Output a list of dependencies that need updating
  • Update the dependency file but not actually install the dependencies (in case you want to manually review/approve before installing dependency updates)
  • Install the updated dependencies (for a fully automated workflow)

Copy link
Collaborator

@cbullinger cbullinger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

- Uses `dotnet` CLI
- Runs `dotnet restore` and `dotnet build` for full updates

## Output Example
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

love this

case UpdateFile:
// Use mvn versions:use-latest-releases to update pom.xml
// Note: Maven doesn't have a built-in way to distinguish direct vs transitive dependencies
// in the update command, so directOnly flag doesn't affect Maven updates
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

### Flags

- `-p, --path`: Starting filepath or directory to scan (default: current directory)
- `--direct-only`: Only check direct dependencies (excludes indirect/dev dependencies)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe note here which languages/files this doesn't work with (e.g. Java/Maven)

@dacharyc dacharyc merged commit 3416f19 into main Nov 19, 2025
1 check passed
@dacharyc dacharyc deleted the dependency-manager branch November 19, 2025 16:49
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants