dependabot / dependabot/dependabot-core

Make changes to maintainers or install scripts more prominent

Open
#14,580 1 comment 7 reactions 0 assignees View on GitHub
T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

Dependabot now helpfully flags when a dependency gets a new maintainer, or if install scripts change between versions.

Unfortunately I think these can be easily missed, especially as the important information is concealed behind a `` element.

I'd suggest:

- front-loading these indicators by moving them before the release notes / commit information
- not using ``, as the concealed information is both important and short
- potentially using GitHub's [markdown alerts](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#alerts) to draw attention (exact severity level to be bike-shedded, I'm sure 😉)

It might look something like:

Image

I can see a similar idea has been discussed in https://github.com/dependabot/dependabot-core/issues/12765#issuecomment-3900480964 for highlighting when a package loses provenance.

I'd be happy to contribute a change if this would be welcomed.

Contributor guide

Open the contributing guide

Research direction

No file or test entry point is named. Start by locating the code that assembles Dependabot update pull request descriptions, then trace how maintainer-change and install-script indicators are rendered. Done means those indicators appear before release notes, are not hidden in a details element, and use an agreed GitHub alert style if adopted.

Written by the indexing model from the issue text.

Assessment

Tech stack
github
Domain
developer-experience
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.