dependabot / dependabot/dependabot-core
Downgrade cargo package when latest version is yanked
Open
F: dependency-downgrades
F: language-support
L: rust:cargo
T: feature-request
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 156
Description
In a Rust project, I merged a PR from dependabot to upgrade `bitflags` to 1.0.5. Later, the 1.0.5 release was yanked. I think in this case it'd be appropriate for dependabot to _lower_ the version to 1.0.4, the otherwise latest version. I think this behavior makes sense because if I run `cargo update` locally, I get a downgrade. You can see this with the following repository: https://github.com/alex/csv-sql
Contributor guide
Assessment
This issue has not been assessed yet.