Dependency management

[neubig]

1. Upgrade npm packages to the most recent version that is at least one week old. Do not use carat dependencies, pin exact versions
2. Add dependabot CI to do the same

Make sure that CI passes after this.

[openhands-ai]

I'm on it! neubig can track my progress at all-hands.dev

[openhands-ai]

Final summary of work so far:

Status

• Reviewed the repository’s current dependency-management setup
• Confirmed that Dependabot is already configured
• Checked the currently open Dependabot PRs and their CI status
• Assessed whether merging those PRs alone would satisfy issue Dependency management #136
• Fully complete issue Dependency management #136
• Make repo changes, run validation, commit, push, and open a PR

Answer to the question

The answer is: no, there is still more to do.
Merging the currently open Dependabot PRs would not fully resolve the issue, because the existing setup does not yet cover all of the stated requirements:

• it only targets the repo root, not the example app
• it does not enforce exact pinned versions
• it does not enforce the “at least one week old” dependency policy
• the open PRs only cover a subset of dependency updates

Conciseness

• No repository changes were finalized after the last summary.
• No extraneous code/config changes were introduced that would need reverting.

Net result

So far, I have analyzed and clarified the gap, but the request has not yet been completely addressed.