dependabot / dependabot/dependabot-core

Make `allow` and `ignore` symmetric

Open
#3,479 8 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

F: configuration-file F: dependency-ignores T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 13h
Merged PRs (30d)
151

Description

Currently, Dependabot offers two ways of opting dependencies in or out of updates: allow and ignore. The main differences (from a config file functionality standpoint) are:

  • allow has the ability to specify dependency-type's (e.g. development, production) to allow a certain number of dependencies
  • ignore has the ability to opt out of certain versions, while allow can't opt you in to certain versions (e.g. only allow updates on x.y.z not x+1.y.z).

It certainly feels useful to be able to write something like:

updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    ignore:
      - dependency-type: "development"

Which would fulfill issues like https://github.com/dependabot/dependabot-core/issues/3475

We also offer a @dependabot ignore command without a corresponding @dependabot allow command, though dependabot updates everything by default, so allow might be redundant, unless you're trying to opt back in after you've opted out.

As an internal implementation note, I believe allow and ignore run at different times, so potentially we might want to unify this, or further clarify this behavior.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No implementation files or tests are named. Start by tracing how the configuration handles allow and ignore, including their stated processing order, then review the @dependabot ignore command and issue 3475. Done means the agreed allow and ignore behavior is symmetric for dependency types, versions, and commands.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.