dependabot / dependabot/dependabot-core
Make changes to maintainers or install scripts more prominent
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
Dependabot now helpfully flags when a dependency gets a new maintainer, or if install scripts change between versions.
Unfortunately I think these can be easily missed, especially as the important information is concealed behind a `` element.
I'd suggest:
- front-loading these indicators by moving them before the release notes / commit information
- not using ``, as the concealed information is both important and short
- potentially using GitHub's [markdown alerts](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#alerts) to draw attention (exact severity level to be bike-shedded, I'm sure 😉)
It might look something like:
I can see a similar idea has been discussed in https://github.com/dependabot/dependabot-core/issues/12765#issuecomment-3900480964 for highlighting when a package loses provenance.
I'd be happy to contribute a change if this would be welcomed.
Contributor guide
Research direction
No file or test entry point is named. Start by locating the code that assembles Dependabot update pull request descriptions, then trace how maintainer-change and install-script indicators are rendered. Done means those indicators appear before release notes, are not hidden in a details element, and use an agreed GitHub alert style if adopted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github
- Domain
- developer-experience
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100