dependabot / dependabot/dependabot-core
Version update PRs understate what's being updated in title and description
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 156
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
nuget
### Package manager version
_No response_
### Language version
MSBuild
### Manifest location and content before the Dependabot update
/Directory.Packages.props
```xml
true
true
2.0.171
61.0.15-preview
0.12.8-experimental
0.1.42-alpha
4.12.0
3.11.0
```
### dependabot.yml content
```yml
# Please see the documentation for all configuration options:
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
version: 2
updates:
- package-ecosystem: nuget
directory: /
schedule:
interval: weekly
groups:
nerdbank-gitversioning:
patterns:
- nbgv
- nerdbank.gitversioning
xunit:
patterns:
- 'xunit*'
- package-ecosystem: dotnet-sdk
directory: /
schedule:
interval: monthly
ignore:
- dependency-name: MessagePack # We have to use the MessagePack version used by win32metadata (https://github.com/microsoft/CsWin32/issues/371)
```
### Updated dependency
```diff
- 3.11.0
+ 4.12.0
-
+
-
-
-
+
+
+
```
### What you expected to see, versus what you actually saw
The PR title was: "Bump MessagePackAnalyzer from 2.5.108 to 2.5.192" but it updated much more than that.
The PR description carried on this understatement, claiming to only "Bumps [MessagePackAnalyzer](https://github.com/MessagePack-CSharp/MessagePack-CSharp) from 2.5.108 to 2.5.192."
Yet I've seen other Dependabot PRs with descriptions that call out that more had to be updated because of interactions between dependencies. But this one didn't.
**Most importantly**, the alleged package update [has no dependencies of its own](https://www.nuget.org/packages/messagepackanalyzer#dependencies-body-tab) and therefore totally should not have required updating any other packages.
### Native package manager behavior
I would have expected any other tool to just update MessagePackAnalyzer itself if I asked it to update that one.
### Images of the diff or a link to the PR, issue, or logs
https://github.com/microsoft/CsWin32/pull/1327
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.