dependabot / dependabot/dependabot-core

Cargo: Support ignoring git dependencies

Open
#4,388 2 comments 1 reaction 0 assignees View on GitHub
F: configuration-file F: dependency-ignores L: rust:cargo T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

An example of git dependency:
```toml
[dependencies]
regex = { git = "https://github.com/rust-lang/regex" }
```
Currently, there is no way to tell dependabot to ignore such a dependency update in `Cargo.lock`, but to specify its name.
Ignoring syntax could be
```yml
update-types: ["git"]
```
https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/config/ignore_condition.rb

Unless this feature is already supported, but not documented yet.

Contributor guide

Open the contributing guide

Research direction

Start with common/lib/dependabot/config/ignore_condition.rb and inspect how ignore conditions and update-types are currently parsed, then check whether Cargo git dependencies are handled elsewhere. Confirm whether the proposed "git" condition already works; done means the behavior is supported or its documented limitation and required configuration are clear.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby, rust
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.