dependabot / dependabot/dependabot-core

Ruby version mismatch

Open
#10,108 1 comment 0 reactions 0 assignees View on GitHub
L: dart:pub L: git:submodules L: github:actions L: ruby:bundler T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

Bundler

### Package manager version

2.5.6

### Language version

3.3.0

### Manifest location and content before the Dependabot update

/Gemfile

### dependabot.yml content

version: 2
updates:
- package-ecosystem: bundler
directory: /
registries: "*"
schedule:
interval: daily

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

I've added Dependabot to a Ruby 3.3.0 app. Dependabot couldn't resolve dependencies because `prometheus-client-mmap` depends on >= Ruby 2.7.0 but Dependabot was somehow using Ruby 2.6.9. The error message:

```
Handled error whilst updating : dependency_file_not_resolvable {:message=>"Could not find compatible versions\n\nBecause prometheus-client-mmap >= 1.1.0, < 1.1.1 depends on Ruby >= 2.7, < 3.4.dev\n and prometheus-client-mmap = 1.1.0 depends on Ruby >= 2.7.0,\n and current Ruby version is = 2.6.9,\n version solving has failed."}
```

My app declares the Ruby version as 3.3.0 via `.ruby-version`.

Looking for a public repo example, I've seen this for `dependabot-core`: https://github.com/dependabot/dependabot-core/actions/runs/9678038683/job/26700936769 It's the same type of error as mine.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the /Gemfile, .ruby-version, and dependabot.yml configuration described in the report, then compare them with the dependency-resolution log showing Ruby 2.6.9. Check the referenced dependabot-core workflow for a related reproduction. Done means the Bundler update process resolves dependencies against the application's declared Ruby 3.3.0 version.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.