dependabot / dependabot/dependabot-core

Support Volta upgrades

Open
#3,038 0 comments 38 reactions 0 assignees View on GitHub
Keep T: feature-request T: new-ecosystem
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

Volta helps to mitigate the "works on my machine" problem by pinning the exact versions of the tooling to use in each project, such as `node`, `yarn`, and `npm`.

For example, if we want a project to use `node` 14 and `npm` 7, we can do:

```sh-session
$ volta pin node@14
$ volta pin npm@7
```

This will generate an entry in the `package.json` such as:

```json
"volta": {
"node": "14.15.4",
"npm": "7.4.2"
},
```

As you may note, despite we pinned `node@14`, volta writes down the full version specifier, even the patch number. Support for accepting floating versions such as simply `14` [is not going to happen](https://github.com/volta-cli/volta/issues/905).

One can upgrade node and npm to their latest minor and patch releases by running the pin commands again.

However, if we had **dependabot** to work on this, we would not forget to do this by hand and could enjoy a much-automated process of upgrading the `node`, `yarn`, and `npm` versions.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the package.json `volta` block and the documented `volta pin node` and `volta pin npm` commands. Trace how Dependabot currently handles Node, npm, and Yarn updates, then determine the tests needed to verify that pinned full versions receive automated minor and patch upgrades.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js, ruby
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.