dependabot / dependabot/dependabot-core

Dependencies with same name prefix and version are updated together falsely

Open
#13,883 0 comments 0 reactions 0 assignees View on GitHub
L: java:gradle T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues
#9799
#14214

### Package ecosystem

Gradle

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

_No response_

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

We have multiple internal libraries with the naming scheme `com.example.team:internal-lib`.
When we use multiple of these libs (which are versioned independently and have different names), Dependabot updates these together, even if one of the dependencies in this version doesn't exist.

Example:
We have
```
implementation("com.example.team:internal-lib:1.0.0")
implementation("com.example.team:lib-other:1.0.0")
```
Now we release `com.example.team:internal-lib:1.1.0`, `lib-other` stays on `1.0.0`.

Dependabot is now creating a PR with
```
implementation("com.example.team:internal-lib:1.1.0")
implementation("com.example.team:lib-other:1.1.0")
```
wich fails CI, because `lib-other:1.1.0` doesn't exist.

How can we configure Dependabot to verify the full name of the dependency?

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

The payload provides no manifest, dependabot.yml, logs, or minimal reproduction; it only identifies the Gradle ecosystem and the dependency-coordinate symptom. Start by reducing the example to two independently versioned libraries, then trace the Gradle dependency matching and update logic. Done means only the dependency with the released full coordinate is updated.

Written by the indexing model from the issue text.

Assessment

Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.