Updating dependencies with overrides when available

[jdalton]

Tell us more.

Overrides in at least the JS ecosystem by way of managers like npm, pnpm, yarn, and bun are starting to come into their own. With projects like Socket Registry (disclaimer: I'm a core dev at Socket) providing drop-in override replacements for packages it would be empowering to be able to subscribe to such feed updates (maybe using registry manifest data). Auto-updating dependencies and swapping out with overrides when available seem like companion features.

[rarkins]

Do you mean doing the replacements (as an alternative to the Socket CLI command), or doing updates of those replacements once they've been made, and a newer version is published?

[jdalton]

This would be as an alternative to the CLI as updates after should be handled by however Renovate handles updates overrides, resolutions, and pnpm.overrides fields.

To be generally applicable I image being able to specify some form of metadata that folks can use to map a dependency to an override.

Ideally looking for a way to tie-in overrides to dependency updates because if you're bumping a version you could also potentially replace it with an override.

💡 Npm overrides are a little more tricky because if the dependency exists as a direct dependency then it needs to be replaced and a $dep-name needs to be used as the package spec in the override (docs).

[jdalton]

@rarkins This may be more along the lines of a preset with Replacements. Thoughts?

[rarkins]

That would work for direct dependencies as a start, but currently there's no established way for the transitive part (the need hasn't arisen before)