dependabot / dependabot/dependabot-core
bunfig.toml file is not respected during Bun update version resolution
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
Bun
### Package manager version
1.3.3
### Language version
NodeJS 24
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
_No response_
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
#### Current behavior
Bun allows the user to set options in the `bunfig.toml` file. This file is currently not read by Dependabot, only `bun.lock` is read
https://github.com/dependabot/dependabot-core/blob/496e649b2e1c15d748fe8cc56162c6e036435068/bun/lib/dependabot/bun/file_fetcher.rb#L98
This means that during package resolution Bun cannot access configuration in this file. One example where this fails for me is the minimum required release age: While Dependabot has the `cooldown` option to configure a minimum package age for the packages to be updated, this does not apply to dependencies of these packages. Using my `bunfig.toml`, I enforce a minimum package age of 48 hours and my build process ensures that this limit is respected via [safe-chain](https://github.com/AikidoSec/safe-chain).
The issue now is that Dependabot updates the lock file without respecting the minimum package age and the version selectors of some updated packages allow using dependencies that are younger than the minimum package age. Dependabot then opens a PR with the updated lock file, containing the young packages. The CI checks in this PR then fail as safe-chain blocks the download of these packages.
#### Expected behavior
Dependabot should respect the `bunfig.toml` file during package resolution. This could easily be achieved by adding the file to the fetched files for the Bun runner.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.