dependabot / dependabot/dependabot-core
When multiple of the same cargo package are used, dependabot doesn't try to update all of them
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 151
Description
Repo: https://github.com/alex/ct-tools
If you look at Cargo.lock, you'll see that bytes is depended on multiple times (one at 0.4.12 and the other at 0.5.2).
However, looking at the update log from dependabot (https://app.dependabot.com/accounts/alex/update-logs/18434808) you can see that it only checks for an update for bytes 0.4.12, not 0.5.2.
You can see the same pattern with smallvec in the same repository.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report using the linked alex/ct-tools repository, starting with Cargo.lock and the Dependabot update log. Compare how updates are checked for both bytes versions and the two smallvec versions; done means each distinct package version is considered for an update.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100