dependabot / dependabot/dependabot-core
Dependabot not updating all versions in package.json
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
npm
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
real repo
- https://github.com/xt0rted/expressive-code-file-icons/blob/main/package.json
minimal repo
- https://github.com/xt0rted-test/dependabot-verions-not-increasing/blob/main/package.json
### dependabot.yml content
real repo
- https://github.com/xt0rted/expressive-code-file-icons/blob/main/.github/dependabot.yml
minimal repo
- https://github.com/xt0rted-test/dependabot-verions-not-increasing/blob/main/.github/dependabot.yml
### Updated dependency
- @vitest/coverage-v8
- vitest
Both went from 3.0.6 to 3.0.7
- @tailwindcss/vite
- tailwindcss
Both went from 4.0.0-beta.5 to 4.0.9
### What you expected to see, versus what you actually saw
The PR says both packages were updated and that's reflected in the lock file, but it's not reflected in the package.json file where only the first package's version is updated.
There's different automatic versioning strategies for apps & libraries, but I would not expect a widening of a version for a dev dependency which both vitest & tailwindcss are. On top of that, this repo's versioning strategy set to `increase` which, unless I'm mistaken, means the versions in package.json should always change.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
real repo
- https://github.com/xt0rted/expressive-code-file-icons/pull/16
minimal repo
- https://github.com/xt0rted-test/dependabot-verions-not-increasing/pull/1
- https://github.com/xt0rted-test/dependabot-verions-not-increasing/pull/2
### Smallest manifest that reproduces the issue
minimal repro with both sets of packages
https://github.com/xt0rted-test/dependabot-verions-not-increasing
Contributor guide
Research direction
Start with the minimal reproduction's package.json and .github/dependabot.yml, then compare the dependency changes in the linked pull requests with their lockfile and manifest diffs. Trace how the npm update is represented in the Dependabot core repository. Done means both dependency versions are updated consistently in package.json when the configured strategy is increase.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, ruby
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100