dependabot / dependabot/dependabot-core

Ignore is not respecting in a group dependencies

Open
#10,122 3 comments 4 reactions 0 assignees View on GitHub
F: grouped-updates 🎳 L: git:submodules L: ruby:bundler T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

bundler

### Package manager version

2.4

### Language version

ruby 3.2.2

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

version: 2

updates:
- package-ecosystem: "bundler"
directory: "/"
schedule:
interval: "daily"
groups:
production-dependencies:
dependency-type: "production"
development-dependencies:
dependency-type: "development"
dependabot.yml-file#ignore
ignore:
- dependency-name: "parser"
update-types: ["version-update:semver-major", "version-update:semver-minor"]

### Updated dependency

parser

### What you expected to see, versus what you actually saw

I want to ignore all major and minor, only accept patches, but it changing my Gemlock to major.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

https://github.com/AlexcastroDev/dependabot_parse/pull/1

Contributor guide

Open the contributing guide

Research direction

Start with the dependabot.yml configuration in the issue and inspect the linked minimal reproduction pull request. Trace how the Bundler group rules and ignore entries are interpreted, then reproduce the update and verify that major and minor parser updates are ignored while patch updates remain eligible.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.