alibaba / alibaba/fastjson2

[QUESTION]因版本号包含“.android8”后缀,导致 Dependabot 自动升级 PR 选择了带.android8后缀的版本

Open
#4,026 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
Java
Stars
4.4k
Forks
613
Avg merge
1d 22h
Merged PRs (30d)
6

Description

### 问题:因版本号包含“.android8”后缀,导致 Dependabot 自动升级 PR 选择了带后缀的版本

* 项目中配置了 Dependabot 定期扫描并升级第三方依赖。例如,我们希望将 `com.alibaba.fastjson2:fastjson2` 从 `2.0.60` 升级到 `2.0.61`(注意:不是带 `.android8` 后缀的版本)。然而 Dependabot 生成的 Pull Request 却将版本更新为 `2.0.61.android8`:

```
chore(deps): bump com.alibaba.fastjson2:fastjson2 from 2.0.60 to 2.0.61.android8
```

而我们期望的是:

```
chore(deps): bump com.alibaba.fastjson2:fastjson2 from 2.0.60 to 2.0.61
```

此问题在每次升级时都会出现。
由于 GitHub Dependabot 目前不支持针对特定版本后缀的过滤策略,请问有什么方法可以避免定期检查升级时出现这种版本选择偏差?

Contributor guide

Open the contributing guide

Research direction

No repository file or test is identified; begin with the project's Dependabot configuration and the dependency versions described in the report. Determine whether the recurring selection of 2.0.61.android8 can be addressed in fastjson2 or requires a Dependabot-side workaround; done means updates select 2.0.61 instead.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.