dependabot / dependabot/dependabot-core

Documentation should clarify SemVer ignore behavior for non-SemVer versions

Open
#4,386 3 comments 3 reactions 0 assignees View on GitHub
E: documentation F: configuration-file F: dependency-ignores service 💁 T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

Current documentation does not describe dependabot update behavior in the following situations:

1. Ignore set to `update-types: ["version-update:semver-major"]` with a version like `1.2` or `1.2.3.4`.
2. Same with an update between SemVer and not, eg `1.2->3.0.0` or `1.2.3->2.0`

In the above situations I can reasonably expect that dependabot will either:

1. Treat `1` as **major** in `1.2` and ignore major updates on a 2-digit version.
2. Treat `1` as **major** in `1.2.3` but not in `1.2` and thus ignore only one of these updates: `1.2->3.0.0`, `1.2.3->2.0` (I have no idea which)
3. Not honor the ignore instruction at all for any non-SemVer versions and process updates regardless of ignore configuration.

In a similar vein, what is the expected behavior for processing semver instructions on completely non-semver versions?
* 1.2-monkey3
* 1234
* 1-SOME-WORD

Contributor guide

Open the contributing guide

Research direction

No documentation file, test, or entry point is named. First determine how Dependabot handles the listed SemVer and non-SemVer cases, then identify the relevant documentation location. Done means the documentation explicitly describes ignore behavior for each example and the SemVer/non-SemVer cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
documentation, tooling
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.