dependabot / dependabot/dependabot-core

Dependabot not grouping PRs for each directory

Open
#10,474 0 comments 3 reactions 0 assignees View on GitHub
F: grouped-updates 🎳 L: javascript T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

```

version: 2
updates:
- package-ecosystem: "npm"
directories:
- "/lambda/functions/nodejs/"
- "/lambda/layer/nodejs/"
schedule:
interval: "weekly" # Default day is Monday
time: "09:00"
groups:
version-update-dependencies:
applies-to: version-updates
patterns:
- "*"
update-types:
- "minor"
- "patch"
security-update-dependencies:
applies-to: security-updates
patterns:
- "*"
update-types:
- "patch"
- "minor"
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
labels:
- "dependencies"
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Expected:
We were expecting one PR per directory as per group rules

What we saw:
Dependabot created different PRs for the dependencies and didn't group

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

Below are the logs for update job on first directory
```
updater | 2024/08/20 12:03:11 INFO Requirements to unlock update_not_possible
updater | 2024/08/20 12:03:11 INFO Requirements update strategy widen_ranges
updater | 2024/08/20 12:03:11 INFO No update possible for eslint-config-standard-with-typescript
updater | 2024/08/20 12:03:11 INFO Finished job processing
updater | 2024/08/20 12:03:11 INFO Results:
updater | +-------------------------------------------------------+
updater | | Changes to Dependabot Pull Requests |
updater | +---------+---------------------------------------------+
updater | | created | winston ( from 2.4.6 to 2.4.7 ) |
updater | | created | eslint ( from 8.57.0 to 9.9.0 ) |
updater | | created | sinon ( from 15.2.0 to 18.0.0 ) |
updater | | created | uuid ( from 8.3.2 to 10.0.0 ) |
updater | | created | nyc ( from 15.1.0 to 17.0.0 ) |
updater | | created | aws-sdk-client-mock ( from 1.0.0 to 4.0.1 ) |
updater | | created | aws-sdk-mock ( from 5.9.0 to 6.1.1 ) |
updater | | created | node-fetch ( from 2.7.0 to 3.3.2 ) |
updater | | created | typescript ( from 4.9.5 to 5.5.4 ) |
updater | +---------+---------------------------------------------+
updater | time="2024-08-20T12:03:11Z" level=info msg="task complete" container_id=job-871752814-updater exit_code=0 job_id=871752814 step=updater
```
Below are the logs for update job on second directory

```
updater | 2024/08/20 12:03:04 INFO Latest version is 2.29.1
proxy | 2024/08/20 12:03:06 Posting metrics to remote API endpoint
proxy | 2024/08/20 12:03:06 Successfully posted metrics data via api client
updater | 2024/08/20 12:03:12 INFO Requirements to unlock update_not_possible
updater | 2024/08/20 12:03:12 INFO Requirements update strategy widen_ranges
updater | 2024/08/20 12:03:12 INFO No update possible for eslint-plugin-import
updater | 2024/08/20 12:03:12 INFO Finished job processing
updater | 2024/08/20 12:03:12 INFO Results:
updater | +-------------------------------------------------------+
updater | | Changes to Dependabot Pull Requests |
updater | +---------+---------------------------------------------+
updater | | created | winston ( from 2.4.6 to 2.4.7 ) |
updater | | created | uuid ( from 8.3.2 to 10.0.0 ) |
updater | | created | node-fetch ( from 2.7.0 to 3.3.2 ) |
updater | | created | eslint ( from 8.57.0 to 9.9.0 ) |
updater | | created | typescript ( from 4.9.5 to 5.5.4 ) |
updater | | created | nyc ( from 15.1.0 to 17.0.0 ) |
updater | | created | aws-sdk-client-mock ( from 1.0.0 to 4.0.1 ) |
updater | +---------+---------------------------------------------+
updater | time="2024-08-20T12:03:12Z" level=info msg="task complete" container_id=job-871752817-updater exit_code=0 job_id=871752817 step=updater
```

![Screenshot 2024-08-21 at 4 01 52 PM](https://github.com/user-attachments/assets/ee2da0e3-1a18-4184-a10c-d80d27eea3eb)

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the supplied dependabot.yml, focusing on the npm update configuration that lists two directories and defines groups. Reproduce the behavior using the two updater-job log examples and trace how each directory's updates are grouped. Done means the configured group rules produce one pull request per directory rather than separate dependency pull requests.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.