dependabot / dependabot/dependabot-core
[pnpm] dependabot updates transitive dependencies when unnecessary
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 156
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
pnpm
### Package manager version
pnpm `9.15.4`
### Language version
_No response_
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
_No response_
### Updated dependency
eslint from 9.20.0 to 9.20.1
### What you expected to see, versus what you actually saw
Only eslint and what's necessary should be bumped
### Native package manager behavior
Unnecessary bumps occur.
For instance:

ts-node has a `"@types/node": "*",` dependency, so it should not require a bump of `@types/node`.
This is a problem, because this results in:
- unexpected patches being applied within the repository, which are not being reviewed and could break production
- in the case of `@types/node`, conflicts with other `@types/node` versions in the repository, resulting in type checking issues
I'm not 100% sure, but it looks like it might only be happening with `*` transitive dependencies.
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.