dependabot / dependabot/dependabot-core
Support Volta upgrades
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
Volta helps to mitigate the "works on my machine" problem by pinning the exact versions of the tooling to use in each project, such as `node`, `yarn`, and `npm`.
For example, if we want a project to use `node` 14 and `npm` 7, we can do:
```sh-session
$ volta pin node@14
$ volta pin npm@7
```
This will generate an entry in the `package.json` such as:
```json
"volta": {
"node": "14.15.4",
"npm": "7.4.2"
},
```
As you may note, despite we pinned `node@14`, volta writes down the full version specifier, even the patch number. Support for accepting floating versions such as simply `14` [is not going to happen](https://github.com/volta-cli/volta/issues/905).
One can upgrade node and npm to their latest minor and patch releases by running the pin commands again.
However, if we had **dependabot** to work on this, we would not forget to do this by hand and could enjoy a much-automated process of upgrading the `node`, `yarn`, and `npm` versions.
Contributor guide
Research direction
Start by reviewing the package.json `volta` block and the documented `volta pin node` and `volta pin npm` commands. Trace how Dependabot currently handles Node, npm, and Yarn updates, then determine the tests needed to verify that pinned full versions receive automated minor and patch upgrades.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js, ruby
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100