dependabot / dependabot/dependabot-core
Swift integration missing upgrades for indirect/transitive dependencies
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
The Dependabot documentation [lists package managers with support for indirect dependencies](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#dependency-type-allow) (also known as transitive dependencies).
Swift Package Manager is currently missing from the list, even if the `swift package update` command certainly updates both direct and indirect package dependencies.
Dependabot's integration for Swift projects should be extended to support indirect dependencies on Swift packages.
Contributor guide
Research direction
The issue names no repository files or tests; start by locating Dependabot's Swift Package Manager integration and how it represents direct versus indirect dependencies. Compare its behavior with the documented dependency-type support and the `swift package update` command, then verify that Swift package updates include indirect dependencies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- devtools
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100