dependabot / dependabot/dependabot-core

Dependabot not updating all versions in package.json

Open
#11,706 0 comments 1 reaction 0 assignees View on GitHub
L: javascript T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

real repo
- https://github.com/xt0rted/expressive-code-file-icons/blob/main/package.json

minimal repo
- https://github.com/xt0rted-test/dependabot-verions-not-increasing/blob/main/package.json

### dependabot.yml content

real repo
- https://github.com/xt0rted/expressive-code-file-icons/blob/main/.github/dependabot.yml

minimal repo
- https://github.com/xt0rted-test/dependabot-verions-not-increasing/blob/main/.github/dependabot.yml

### Updated dependency

- @vitest/coverage-v8
- vitest

Both went from 3.0.6 to 3.0.7

- @tailwindcss/vite
- tailwindcss

Both went from 4.0.0-beta.5 to 4.0.9

### What you expected to see, versus what you actually saw

The PR says both packages were updated and that's reflected in the lock file, but it's not reflected in the package.json file where only the first package's version is updated.

There's different automatic versioning strategies for apps & libraries, but I would not expect a widening of a version for a dev dependency which both vitest & tailwindcss are. On top of that, this repo's versioning strategy set to `increase` which, unless I'm mistaken, means the versions in package.json should always change.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

real repo
- https://github.com/xt0rted/expressive-code-file-icons/pull/16

minimal repo
- https://github.com/xt0rted-test/dependabot-verions-not-increasing/pull/1
- https://github.com/xt0rted-test/dependabot-verions-not-increasing/pull/2

### Smallest manifest that reproduces the issue

minimal repro with both sets of packages

https://github.com/xt0rted-test/dependabot-verions-not-increasing

Contributor guide

Open the contributing guide

Research direction

Start with the minimal reproduction's package.json and .github/dependabot.yml, then compare the dependency changes in the linked pull requests with their lockfile and manifest diffs. Trace how the npm update is represented in the Dependabot core repository. Done means both dependency versions are updated consistently in package.json when the configured strategy is increase.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, ruby
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.