Maintain Your Plugin

You're free to maintain your plugin in whatever way suits you. However, we do have a couple of recommendations for you to get started:

Dependabot

We like to use the dependabot Github integration. Dependabot will automatically create PRs to bump dependency versions in your package. This is an easy way to make sure that you're keeping your dependency tree up to date.

You can see example of how we configure dependabot here: https://github.com/salesforcecli/cli/blob/main/.github/dependabot.yml

Snyk

We use snyk code checker to scan pull requests for security and quality issues.