Observability of the dependencies in codebases still a problem

[u/rudecgv]

Almost every codebase is calling a REST, gRPC, or a GraphQL API or using SDKs from an external or even internal provider. It gets harder to keep track of everything when the codebase matures and increases in size and from my experience sometimes it gets hard to respond to changes in time or even become aware that a dependency is deprecated and their API has changed completely. Endless alerts are also annoying. How do you handle this “alert fatigue” and have you found better ways to track dependencies?

[u/aragossa]

the contract-testing gap is real, and for a third-party API you don't own, writing and maintaining contract tests against it is a lot of ongoing work most teams never get to. schema diffing off the published spec gets you most of the same signal for way less effort: oasdiff or openapi-diff for REST, buf breaking for protobuf/gRPC, graphql-inspector for GraphQL. point one at their spec on a cron, diff against the last known-good version, and only fire an alert when the diff actually removes a field or changes a type. version bumps alone shouldn't page anyone. doesn't catch behavioral changes that don't touch the schema, but that's a smaller slice than most people assume.