dependabot / dependabot/dependabot-core
Dependabot not grouping PRs for each directory
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
npm
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
```
version: 2
updates:
- package-ecosystem: "npm"
directories:
- "/lambda/functions/nodejs/"
- "/lambda/layer/nodejs/"
schedule:
interval: "weekly" # Default day is Monday
time: "09:00"
groups:
version-update-dependencies:
applies-to: version-updates
patterns:
- "*"
update-types:
- "minor"
- "patch"
security-update-dependencies:
applies-to: security-updates
patterns:
- "*"
update-types:
- "patch"
- "minor"
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
labels:
- "dependencies"
```
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
Expected:
We were expecting one PR per directory as per group rules
What we saw:
Dependabot created different PRs for the dependencies and didn't group
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
Below are the logs for update job on first directory
```
updater | 2024/08/20 12:03:11 INFO Requirements to unlock update_not_possible
updater | 2024/08/20 12:03:11 INFO Requirements update strategy widen_ranges
updater | 2024/08/20 12:03:11 INFO No update possible for eslint-config-standard-with-typescript
updater | 2024/08/20 12:03:11 INFO Finished job processing
updater | 2024/08/20 12:03:11 INFO Results:
updater | +-------------------------------------------------------+
updater | | Changes to Dependabot Pull Requests |
updater | +---------+---------------------------------------------+
updater | | created | winston ( from 2.4.6 to 2.4.7 ) |
updater | | created | eslint ( from 8.57.0 to 9.9.0 ) |
updater | | created | sinon ( from 15.2.0 to 18.0.0 ) |
updater | | created | uuid ( from 8.3.2 to 10.0.0 ) |
updater | | created | nyc ( from 15.1.0 to 17.0.0 ) |
updater | | created | aws-sdk-client-mock ( from 1.0.0 to 4.0.1 ) |
updater | | created | aws-sdk-mock ( from 5.9.0 to 6.1.1 ) |
updater | | created | node-fetch ( from 2.7.0 to 3.3.2 ) |
updater | | created | typescript ( from 4.9.5 to 5.5.4 ) |
updater | +---------+---------------------------------------------+
updater | time="2024-08-20T12:03:11Z" level=info msg="task complete" container_id=job-871752814-updater exit_code=0 job_id=871752814 step=updater
```
Below are the logs for update job on second directory
```
updater | 2024/08/20 12:03:04 INFO Latest version is 2.29.1
proxy | 2024/08/20 12:03:06 Posting metrics to remote API endpoint
proxy | 2024/08/20 12:03:06 Successfully posted metrics data via api client
updater | 2024/08/20 12:03:12 INFO Requirements to unlock update_not_possible
updater | 2024/08/20 12:03:12 INFO Requirements update strategy widen_ranges
updater | 2024/08/20 12:03:12 INFO No update possible for eslint-plugin-import
updater | 2024/08/20 12:03:12 INFO Finished job processing
updater | 2024/08/20 12:03:12 INFO Results:
updater | +-------------------------------------------------------+
updater | | Changes to Dependabot Pull Requests |
updater | +---------+---------------------------------------------+
updater | | created | winston ( from 2.4.6 to 2.4.7 ) |
updater | | created | uuid ( from 8.3.2 to 10.0.0 ) |
updater | | created | node-fetch ( from 2.7.0 to 3.3.2 ) |
updater | | created | eslint ( from 8.57.0 to 9.9.0 ) |
updater | | created | typescript ( from 4.9.5 to 5.5.4 ) |
updater | | created | nyc ( from 15.1.0 to 17.0.0 ) |
updater | | created | aws-sdk-client-mock ( from 1.0.0 to 4.0.1 ) |
updater | +---------+---------------------------------------------+
updater | time="2024-08-20T12:03:12Z" level=info msg="task complete" container_id=job-871752817-updater exit_code=0 job_id=871752817 step=updater
```

### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start with the supplied dependabot.yml, focusing on the npm update configuration that lists two directories and defines groups. Reproduce the behavior using the two updater-job log examples and trace how each directory's updates are grouped. Done means the configured group rules produce one pull request per directory rather than separate dependency pull requests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100