Dependabot-core: Better diff for DefinitelyTyped packages

[ybiquitous]

Could you please make the diff of DefinitelyTyped NPM packages (e.g., @types/react) better?

For example, the "compare diff" link in the following PR description points to https://github.com/DefinitelyTyped/DefinitelyTyped/commits.
This URL can tell us nothing about what the update changed. 🤷‍♂️

Now, we're using own tool to output the diff and then commented the diff manually. It is troublesome work. 😕

If Dependabot would do similar tasks instead of us, we would be more happy!

[greysteil]

Interesting, thanks. The monorepo structure used by DefinitelyTyped makes this pretty tricky, especially couple with the lack of information about whether or not it's from a monorepo from npm (see this rfc), but I'd like to do better on it.

[ybiquitous]

Thanks for the quick response. Yes, I understand well the DefinitelyTyped repo is pretty tricky. 😅

I'm looking forward to shipping the feature!

[greysteil]

We have progress! The RFC has been accepted, and now I just need to persuade the TypeScript folks to add the directory to each of their packages when they publish. Shouldn't be too tricky...

Final step will be getting the details included in the registry, and therefore making it possible for Dependabot to use them. We'll get there on this, though!

[ybiquitous]

It's a good news! 🎉

[ybiquitous]

@greysteil Incredible! 👏 👏 👏 👏 👏

[email protected] got the repository.directory field in package.json!

• https://github.com/npm/cli/releases/tag/v6.8.0
• https://docs.npmjs.com/files/package.json#repository

Additionally, React has already it!

• https://github.com/facebook/react/blob/v16.8.2/packages/react/package.json#L23

[greysteil]

Thanks @ybiquitous - we're getting there! Still some work to be done to make it fully supported:

• [ ] Update the npm repo command to use the directory (code is here if you want to put in a PR to npm?)
• [ ] Update the npm website to use the directory details on pages like this one (code is closed source, so we'll need to convince the folks at npm to do this)
• [ ] Similarly, update the yarn website so it uses the directory details on pages like this one (code is here if you want to put in a PR to for folks at yarn?)

I'm going to start using it in Dependabot straight away 🙂

[ybiquitous]

Thanks for your kindfull suggestion! I will start right away for npm repo and Yarn website! 💪

[greysteil]

Great! In the meantime, this PR will get DefinitelyTyped specifying the directory for each of its packages. We're getting there!

[ybiquitous]

I opened this PR npm/cli#163, but yet draft because I don't know how to test... 😓

[ybiquitous]

• Similarly, update the yarn website so it uses the directory details on pages like this one (code is here if you want to put in a PR to for folks at yarn?)

When I researched the public source code of Yarn website, I found the place to render a repository's URL ➡️ here

Perhaps the repository's data source seems to be fetched from Algolia server. 🤔

Here are network captures: ⬇️

If a repository.path field would be filled with a new repository.directory value in package.json, the link URL would be rendered as we expect, without any code change in Yarn website.

It seems that Algolia npm search service doesn't support it yet, so I think there is nothing we can do now... 😓

(Research on https://yarnpkg.com/en/package/react-dom)

[greysteil]

Thanks for the research! Let's get that fixed: https://github.com/algolia/npm-search/pull/320. 🤞

[ybiquitous]

Great! 👏👏👏

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs within seven days. Thank you for your contributions.