dependabot / dependabot/dependabot-core
Be able to update gems with the `--conservative` behaviour in bundler
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 156
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
I want that Dependabot runs Bundler with the `--conservative` behaviour, so only the dependency that Dependabot opened the pull request for, is updated.
Here's a example where `webmock` was bumped by Dependabot [in my project](https://github.com/Starkast/wikimum/pull/817), but we can see that bigdecimal, public_suffix, crack and hashdiff was also updated. However, Dependabot only posted release notes, changelog and commits for webmock, so it is not clear to me what changed in these other dependencies.
```shell
$ bundle update webmock
Fetching gem metadata from https://rubygems.org/.........
Resolving dependencies...
Resolving dependencies...
Fetching bigdecimal 3.3.1 (was 3.2.2)
Fetching public_suffix 6.0.2 (was 6.0.1)
Fetching hashdiff 1.2.1 (was 1.1.2)
Installing bigdecimal 3.3.1 (was 3.2.2) with native extensions
Installing public_suffix 6.0.2 (was 6.0.1)
Installing hashdiff 1.2.1 (was 1.1.2)
Fetching crack 1.0.1 (was 1.0.0)
Installing crack 1.0.1 (was 1.0.0)
Fetching webmock 3.26.0 (was 3.25.1)
Installing webmock 3.26.0 (was 3.25.1)
Updating files in vendor/cache
* webmock-3.26.0.gem
* bigdecimal-3.3.1.gem
* public_suffix-6.0.2.gem
* crack-1.0.1.gem
* hashdiff-1.2.1.gem
Removing outdated .gem files from vendor/cache
* bigdecimal-3.2.2.gem
* crack-1.0.0.gem
* hashdiff-1.1.2.gem
* public_suffix-6.0.1.gem
* webmock-3.25.1.gem
Bundle updated!
1 installed gem you directly depend on is looking for funding.
Run `bundle fund` for details
```
```shell
$ bundle update --conservative webmock
Fetching gem metadata from https://rubygems.org/.........
Resolving dependencies...
Resolving dependencies...
Using webmock 3.26.0 (was 3.25.1)
Updating files in vendor/cache
* webmock-3.26.0.gem
Removing outdated .gem files from vendor/cache
* webmock-3.25.1.gem
Bundle updated!
1 installed gem you directly depend on is looking for funding.
Run `bundle fund` for details
```
I can see the `--conservative` flag/behaviour has been mentioned in https://github.com/dependabot/dependabot-core/issues/7572 and in https://github.com/dependabot/dependabot-core/issues/8022.
Contributor guide
Assessment
This issue has not been assessed yet.