dependabot / dependabot/dependabot-core

[pnpm] dependabot updates transitive dependencies when unnecessary

Open
#11,620 6 comments 9 reactions 0 assignees View on GitHub
L: javascript T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 14h
Merged PRs (30d)
156

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

pnpm

### Package manager version

pnpm `9.15.4`

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

_No response_

### Updated dependency

eslint from 9.20.0 to 9.20.1

### What you expected to see, versus what you actually saw

Only eslint and what's necessary should be bumped

### Native package manager behavior

Unnecessary bumps occur.

For instance:

![Image](https://github.com/user-attachments/assets/29657a6d-af13-4df7-bd53-3573daf3389d)

ts-node has a `"@types/node": "*",` dependency, so it should not require a bump of `@types/node`.

This is a problem, because this results in:
- unexpected patches being applied within the repository, which are not being reviewed and could break production
- in the case of `@types/node`, conflicts with other `@types/node` versions in the repository, resulting in type checking issues

I'm not 100% sure, but it looks like it might only be happening with `*` transitive dependencies.

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.