chore: Dependency health configurations

.github/dependabot.yml

@@ -0,0 +1,69 @@
+version: 2
+updates:
+    # We need to point to each package.json, so this file will be a bit verbose
+
+    # Root package.json
+    - package-ecosystem: 'pnpm'
+      directory: '/'
+      schedule:
+          interval: 'monthly'
+      reviewers:
+          - 'AllenInstitute/app-dev'
+      commit-message:
+          prefix: 'chore(deps):'
+
+    # Packages
+    - package-ecosystem: 'pnpm'
+      directory: '/packages/geometry'
+      schedule:
+          interval: 'monthly'
+      reviewers:
+          - 'AllenInstitute/app-dev'
+      commit-message:
+          prefix: 'chore(deps):'
+
+    - package-ecosystem: 'pnpm'
+      directory: '/packages/scatterbrain'
+      schedule:
+          interval: 'monthly'
+      reviewers:
+          - 'AllenInstitute/app-dev'
+      commit-message:
+          prefix: 'chore(deps):'
+
+    # Examples
+    - package-ecosystem: 'pnpm'
+      directory: '/apps/common'
+      schedule:
+          interval: 'monthly'
+      reviewers:
+          - 'AllenInstitute/app-dev'
+      commit-message:
+          prefix: 'chore(deps):'
+
+    - package-ecosystem: 'pnpm'
+      directory: '/apps/layers'
+      schedule:
+          interval: 'monthly'
+      reviewers:
+          - 'AllenInstitute/app-dev'
+      commit-message:
+          prefix: 'chore(deps):'
+
+    - package-ecosystem: 'pnpm'
+      directory: '/apps/omezarr-viewer'
+      schedule:
+          interval: 'monthly'
+      reviewers:
+          - 'AllenInstitute/app-dev'
+      commit-message:
+          prefix: 'chore(deps):'
+
+    - package-ecosystem: 'pnpm'
+      directory: '/app/scatterplot'
+      schedule:
+          interval: 'monthly'
+      reviewers:
+          - 'AllenInstitute/app-dev'
+      commit-message:
+          prefix: 'chore(deps):'

.npmrc

@@ -0,0 +1 @@
+save-exact=true

apps/common/package.json

@@ -28,10 +28,10 @@
     "dependencies": {
       "@alleninstitute/vis-geometry": "workspace:*",
       "@alleninstitute/vis-scatterbrain": "workspace:*",
-      "@types/lodash": "^4.14.202",
-      "lodash": "^4.17.21",
-      "regl": "^2.1.0",
-      "zarr": "^0.6.2"
+      "@types/lodash": "4.14.202",
+      "lodash": "4.17.21",
+      "regl": "2.1.0",
+      "zarr": "0.6.2"
 
     }
-  }
+}

apps/layers/package.json

@@ -34,14 +34,14 @@
       "typecheck": "tsc --noEmit"
     },
     "devDependencies": {
-      "esbuild": "^0.19.12",
-      "typescript": "^5.3.3"
+      "esbuild": "0.19.12",
+      "typescript": "5.3.3"
     },
     "dependencies": {
       "@alleninstitute/vis-geometry": "workspace:*",
       "@alleninstitute/vis-scatterbrain": "workspace:*",
-      "@types/lodash": "^4.14.202",
-      "lodash": "^4.17.21",
-      "regl": "^2.1.0"
+      "@types/lodash": "4.14.202",
+      "lodash": "4.17.21",
+      "regl": "2.1.0"
     }
-  }
+  }

apps/omezarr-viewer/package.json

@@ -37,16 +37,16 @@
     "test": "jest --config=jest.config.cjs --watch"
   },
   "devDependencies": {
-    "esbuild": "^0.19.12",
-    "typescript": "^5.3.3"
+    "esbuild": "0.19.12",
+    "typescript": "5.3.3"
   },
   "dependencies": {
     "@alleninstitute/vis-geometry": "workspace:*",
     "@alleninstitute/vis-scatterbrain": "workspace:*",
-    "@types/lodash": "^4.14.202",
-    "@zhobo63/imgui-ts": "^0.1.43",
-    "lodash": "^4.17.21",
-    "regl": "^2.1.0",
-    "zarr": "^0.6.2"
+    "@types/lodash": "4.14.202",
+    "@zhobo63/imgui-ts": "0.1.43",
+    "lodash": "4.17.21",
+    "regl": "2.1.0",
+    "zarr": "0.6.2"
   }
-}
+}

apps/scatterplot/package.json

@@ -34,15 +34,15 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "esbuild": "^0.19.12",
-    "typescript": "^5.3.3"
+    "esbuild": "0.19.12",
+    "typescript": "5.3.3"
   },
   "dependencies": {
     "@alleninstitute/vis-geometry": "workspace:*",
     "@alleninstitute/vis-scatterbrain": "workspace:*",
-    "@types/lodash": "^4.14.202",
-    "@zhobo63/imgui-ts": "^0.1.43",
-    "lodash": "^4.17.21",
-    "regl": "^2.1.0"
+    "@types/lodash": "4.14.202",
+    "@zhobo63/imgui-ts": "0.1.43",
+    "lodash": "4.17.21",
+    "regl": "2.1.0"
   }
-}
+}

docs/dependencies.md

@@ -0,0 +1,11 @@
+# Dependencies
+
+## Locked Dependencies
+All dependencies in this project are locked to specific versions using the `.npmrc` file at the root of the project.
+
+This is to ensure that the project is built and tested with the same versions of dependencies across different environments, and reduces the threat of security vulnerabilities from a more permissive versioning strategy.
+
+## Dependabot
+We run a monthly Dependabot to automatically open PRs to update our dependencies. These are controlled in the `.github/dependabot.yml` file. Because we have multiple packages within this monorepo, that file is somewhat verbose.
+
+When adding a new package or example app, be sure to add a new section to `dependabot.yml`.

package.json

@@ -9,6 +9,6 @@
         "@parcel/packager-ts": "2.12.0",
         "@parcel/transformer-typescript-types": "2.12.0",
         "parcel": "2.12.0",
-        "typescript": "^5.3.3"
+        "typescript": "5.3.3"
     }
 }

packages/geometry/package.json

@@ -46,10 +46,10 @@
     "registry": "https://npm.pkg.github.com/AllenInstitute"
   },
   "devDependencies": {
-    "@parcel/packager-ts": "^2.12.0",
-    "@parcel/transformer-typescript-types": "^2.12.0",
-    "vitest": "^1.4.0",
+    "@parcel/packager-ts": "2.12.0",
+    "@parcel/transformer-typescript-types": "2.12.0",
+    "vitest": "1.4.0",
     "parcel": "2.12.0",
-    "typescript": "^5.3.3"
+    "typescript": "5.3.3"
   }
 }

packages/scatterbrain/package.json

@@ -46,15 +46,14 @@
     "registry": "https://npm.pkg.github.com/AllenInstitute"
   },
   "devDependencies": {
-    "@parcel/packager-ts": "^2.12.0",
-    "@parcel/transformer-typescript-types": "^2.12.0",
-    "@types/lodash": "^4.14.202",
+    "@parcel/packager-ts": "2.12.0",
+    "@parcel/transformer-typescript-types": "2.12.0",
+    "@types/lodash": "4.14.202",
     "parcel": "2.12.0",
-    "typescript": "^5.3.3",
-    "vitest": "^1.4.0"
+    "typescript": "5.3.3",
+    "vitest": "1.4.0"
   },
   "dependencies": {
-    "lodash": "^4.17.21"
-
+    "lodash": "4.17.21"
   }
 }