dependabot / dependabot/dependabot-core

Swift integration missing upgrades for indirect/transitive dependencies

Open
#12,420 0 comments 0 reactions 0 assignees View on GitHub
L: swift T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

The Dependabot documentation [lists package managers with support for indirect dependencies](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#dependency-type-allow) (also known as transitive dependencies).

Swift Package Manager is currently missing from the list, even if the `swift package update` command certainly updates both direct and indirect package dependencies.

Dependabot's integration for Swift projects should be extended to support indirect dependencies on Swift packages.

Contributor guide

Open the contributing guide

Research direction

The issue names no repository files or tests; start by locating Dependabot's Swift Package Manager integration and how it represents direct versus indirect dependencies. Compare its behavior with the documented dependency-type support and the `swift package update` command, then verify that Swift package updates include indirect dependencies.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
devtools
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.