dependabot / dependabot/dependabot-core

cooldown breaks with peer dependencies

Open
#13,693 0 comments 1 reaction 1 assignee Claimed by @v-robaiken View on GitHub
cooldown L: javascript T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

yarn@4.10.3

### Language version

Node.js 24.11.1

### Manifest location and content before the Dependabot update

`/package.json`

### dependabot.yml content

```yaml
version: 2

updates:
- package-ecosystem: npm
directory: "/"
cooldown:
default-days: 14
ignore:
- dependency-name: "@angular/*"
update-types: ["version-update:semver-major"]
```

### Updated dependency

```
Updating @angular/compiler from 20.3.12 to 20.3.15
```

### What you expected to see, versus what you actually saw

#### Things I do not expect to see
* I don't expect to see errors in https://github.com/:org/:repo/actions/workflows/dependabot/dependabot-updates

#### Would be nice to see
* A warning telling me that a package is technically available but is blocked by something (another package that hasn't met cooldown requirements)
* An update to something newer than we have which is able to meet peer dependencies while satisfying cooldown.

#### Actual Results

[Dependabot](https://github.com/:org/:repo/actions/runs/:run/job/:job#step:stage:line)
Dependabot encountered an error performing the update

Error: The updater encountered one or more errors.

For more information see: https://github.com/:org/:repo/network/updates/:update (write access to the repository is required to view the log)

```js

Post-resolution validation
➤ YN0060: │ @angular/compiler is listed by your project with version 20.3.15 (p203fc8), which doesn't satisfy what @angular/compiler-cli and other dependencies request (20.3.12).
➤ YN0086: │ Some peer dependencies are incorrectly met by your project; run yarn explain peer-requirements for details, where is the six-letter p-prefixed code.
➤ YN0086: │ Some peer dependencies are incorrectly met by dependencies; run yarn explain peer-requirements for details.
➤ YN0060: @angular/compiler is listed by your project with version 20.3.15 (p203fc8), which doesn't satisfy what @angular/compiler-cli and other dependencies request (20.3.12).
➤ YN0000: └ Completed
➤ YN0000: ┌ Fetch step
Fetch step
➤ YN0060: @angular/compiler is listed by your project with version 20.3.15 (p203fc8), which doesn't satisfy what @angular/compiler-cli and other dependencies request (20.3.12).
➤ YN0000: └ Completed in 1m 11s
➤ YN0000: ┌ Link step
Link step
➤ YN0060: @angular/compiler is listed by your project with version 20.3.15 (p203fc8), which doesn't satisfy what @angular/compiler-cli and other dependencies request (20.3.12).
➤ YN0000: └ Completed in 27s 146ms
➤ YN0000: · Failed with errors in 1m 39s
proxy | 2025/12/02 16:04:25 [481] POST /update_jobs/:job/record_update_job_error
proxy | 2025/12/02 16:04:26 [481] 204 /update_jobs/:job/record_update_job_error
updater | 2025/12/02 16:04:26 INFO Handled error whilst updating @angular/compiler: dependency_file_not_resolvable {message: "peer dependencies are incorrectly met"}
proxy | 2025/12/02 16:04:26 [483] POST /update_jobs/:job/record_ecosystem_meta
proxy | 2025/12/02 16:04:26 [483] 204 /update_jobs/:job/record_ecosystem_meta
proxy | 2025/12/02 16:04:26 [485] PATCH /update_jobs/:job/mark_as_processed
proxy | 2025/12/02 16:04:26 [485] 204 /update_jobs/:job/mark_as_processed
updater | 2025/12/02 16:04:26 INFO Finished job processing
updater | 2025/12/02 16:04:26 INFO Results:
Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+-----------------------------------------------------------------------------------------------------------+
| Dependencies failed to update |
+-------------------+--------------------------------+------------------------------------------------------+
| Dependency | Error Type | Error Details |
+-------------------+--------------------------------+------------------------------------------------------+
| @angular/compiler | dependency_file_not_resolvable | { |
| | | "message": "peer dependencies are incorrectly met" |
| | | } |
+-------------------+--------------------------------+------------------------------------------------------+
Failure running container :container: Error: Command failed with exit code 1: /bin/sh -c $DEPENDABOT_HOME/dependabot-updater/bin/run update_files
Cleaned up container :container
proxy | 2025/12/02 16:04:30 2/1241 calls cached (0%)
2025/12/02 16:04:30 Posting metrics to remote API endpoint
proxy | 2025/12/02 16:04:30 Successfully posted metrics data via api client
```

### Native package manager behavior

I'm pretty sure that natively `yarn` could be convinced to give me an older version which is able to satisfy peer dependencies, but I'm not sure about the details.

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

Not actually tested, but it should be something like this:

`package.json`:
```json
{
"version": "0.0.0",
"license": "UNLICENSED",
"devDependencies": {
"@angular/compiler": "20.3.12",
"@angular/compiler-cli": "20.3.12"
},
"packageManager": "yarn@4.10.3"
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.