dependabot / dependabot/dependabot-core

bunfig.toml file is not respected during Bun update version resolution

Open
#15,547 0 comments 0 reactions 1 assignee Claimed by @v-robaiken View on GitHub
L: javascript T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

Bun

### Package manager version

1.3.3

### Language version

NodeJS 24

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

_No response_

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

#### Current behavior
Bun allows the user to set options in the `bunfig.toml` file. This file is currently not read by Dependabot, only `bun.lock` is read

https://github.com/dependabot/dependabot-core/blob/496e649b2e1c15d748fe8cc56162c6e036435068/bun/lib/dependabot/bun/file_fetcher.rb#L98

This means that during package resolution Bun cannot access configuration in this file. One example where this fails for me is the minimum required release age: While Dependabot has the `cooldown` option to configure a minimum package age for the packages to be updated, this does not apply to dependencies of these packages. Using my `bunfig.toml`, I enforce a minimum package age of 48 hours and my build process ensures that this limit is respected via [safe-chain](https://github.com/AikidoSec/safe-chain).

The issue now is that Dependabot updates the lock file without respecting the minimum package age and the version selectors of some updated packages allow using dependencies that are younger than the minimum package age. Dependabot then opens a PR with the updated lock file, containing the young packages. The CI checks in this PR then fail as safe-chain blocks the download of these packages.

#### Expected behavior
Dependabot should respect the `bunfig.toml` file during package resolution. This could easily be achieved by adding the file to the fetched files for the Bun runner.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.