dependabot / dependabot/dependabot-core
PowerShell ecosystem: core functionality (native #Requires + RequiredModules on PowerShell Gallery)
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
A part of a series of chunk sized changes.
**Scope note:** this issue is about PowerShell's own **native**, built-in dependency declarations - the `#Requires -Modules` parser directive and the `RequiredModules` key of a module manifest (`.psd1`) - both part of the PowerShell language/module-manifest schema itself. This is **not** [PSDepend](https://github.com/RamblingCookieMonster/PSDepend) or any other third-party dependency manager; PSDepend-specific manifest support is a separate, related request (#13968).
Scope list for the PowerShell ecosystem work:
- Core functionality: `#Requires -Modules` + `RequiredModules` on PowerShell Gallery.
- Microsoft Artifact Registry (MAR) support.
- `using module` + `NestedModules` declaration support.
- Custom/private registry support.
This issue covers: **Core functionality**.
In scope for this issue:
- Registry: PowerShell Gallery (`https://www.powershellgallery.com/api/v2`).
- Declarations: `#Requires -Modules` in `*.ps1` / `*.psm1`, and `RequiredModules` in `*.psd1` module manifests (native PowerShell module manifest schema, not a third-party tool).
- Parse module-specification hashtables and preserve constraint style when updating versions.
Tracked separately:
- MAR support: #15663
- `using module` + `NestedModules`: #15664
- Custom/private registries: #15665
Todo:
- [ ] Open a PR that is ready for PowerShell in [Dependabot Options Reference | GitHub Docs](https://github.com/github/docs/blob/main/content/code-security/reference/supply-chain-security/dependabot-options-reference.md)
Related:
- #13968 (PSDepend-specific manifest support - a different, third-party dependency manager)
Contributor guide
Research direction
Start by reviewing PowerShell's native #Requires -Modules directive and RequiredModules entries in .psd1 manifests, using the PowerShell Gallery v2 endpoint as the target registry. Trace how module-specification hashtables are parsed and how versions are updated; done means both declaration forms are supported while preserving their constraint style, with a ready PR for the Dependabot Options Reference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100