https://latini.dev/tags/dependency-management/Recent content in Dependency-Management on F. Latini - IT EngineerHugoenThu, 15 Oct 2026 08:00:00 +0000https://latini.dev/posts/nobody-merges-the-dependency-bot/Thu, 15 Oct 2026 08:00:00 +0000https://latini.dev/posts/nobody-merges-the-dependency-bot/<p><strong>TL;DR</strong> - Most organisations solved dependency updates by switching on a bot, and the bot now opens more pull requests than anyone will ever review. The problem is not the bot. It is that staying current was shipped as a notification to every repository instead of as a capability of the platform, so every team is asked to make the same judgement about the same bump, with less context than anyone else in the building, for a benefit that lands somewhere else. Drift compounds: one version behind is a pull request, five versions behind is a project, and a forced migration is just drift that finally met a date. The fix is to stop treating currency as a per-repo chore. Upgrade the layers the platform ships once, for everyone. Group application updates into one scheduled change per repository and let it merge itself when the fleet&rsquo;s evidence says it is safe. Run major versions as campaigns with a codemod. And measure lag and version skew, not pull requests opened.</p>