dependabot / dependabot/dependabot-core

PowerShell ecosystem: core functionality (native #Requires + RequiredModules on PowerShell Gallery)

Open
#15,501 0 comments 0 reactions 0 assignees View on GitHub
T: feature-request T: new-ecosystem
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?
- [x] I have searched the existing issues

### Feature description
A part of a series of chunk sized changes.

**Scope note:** this issue is about PowerShell's own **native**, built-in dependency declarations - the `#Requires -Modules` parser directive and the `RequiredModules` key of a module manifest (`.psd1`) - both part of the PowerShell language/module-manifest schema itself. This is **not** [PSDepend](https://github.com/RamblingCookieMonster/PSDepend) or any other third-party dependency manager; PSDepend-specific manifest support is a separate, related request (#13968).

Scope list for the PowerShell ecosystem work:
- Core functionality: `#Requires -Modules` + `RequiredModules` on PowerShell Gallery.
- Microsoft Artifact Registry (MAR) support.
- `using module` + `NestedModules` declaration support.
- Custom/private registry support.

This issue covers: **Core functionality**.

In scope for this issue:
- Registry: PowerShell Gallery (`https://www.powershellgallery.com/api/v2`).
- Declarations: `#Requires -Modules` in `*.ps1` / `*.psm1`, and `RequiredModules` in `*.psd1` module manifests (native PowerShell module manifest schema, not a third-party tool).
- Parse module-specification hashtables and preserve constraint style when updating versions.

Tracked separately:
- MAR support: #15663
- `using module` + `NestedModules`: #15664
- Custom/private registries: #15665

Todo:
- [ ] Open a PR that is ready for PowerShell in [Dependabot Options Reference | GitHub Docs](https://github.com/github/docs/blob/main/content/code-security/reference/supply-chain-security/dependabot-options-reference.md)

Related:
- #13968 (PSDepend-specific manifest support - a different, third-party dependency manager)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing PowerShell's native #Requires -Modules directive and RequiredModules entries in .psd1 manifests, using the PowerShell Gallery v2 endpoint as the target registry. Trace how module-specification hashtables are parsed and how versions are updated; done means both declaration forms are supported while preserving their constraint style, with a ready PR for the Dependabot Options Reference.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.