Bot for updating dependencies

[0ubbe]

Would be nice to have a bot that opens PR for dependency updates, like:

• Renovate
• Greenkeeper

Not sure if this is in work in progress already, I thought it's good to open an issue to keep track of it 👍🏻

[0ubbe]

Speaking with @poteirard, we identified the following two issues around adding automated dependency updates:

Unexpected updates 😪

Some of the dependencies are considered "delicate" to update. For instance, upgrading react-scripts might break react-styleguist without us noticing.

First, we would need to identify those "delicate" dependencies and then make the dependency bot ignore them, relying on us to update them manually as we see fit.

Update side effects 🥴

Updating some of our dependencies might result in visual or behavioral changes in some of the components exposed in this library.

We might not catch those changes. We currently mostly have snapshot tests with some unit tests, here and there but first, we think would be worth to invest on a stronger suite by:

• making a visual screenshot of the output rendered by each component
• testing behaviour in the browser when needed too

[poteirard]

Closing this since we already have security upgrades (provided by Github).

Reopen in case we want something more :)