dependabot / dependabot/dependabot-core

Dependabot doesn't update the PR when the master branch has a force-push

Open
#4,722 9 comments 0 reactions 0 assignees View on GitHub
F: pull-requests F: security-updates 🔐 L: ruby:bundler service 💁 T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

**Package ecosystem**
ruby / bundler

**Package manager version**
Bundler version 2.1.4
**Language version**
ruby 2.7.0p0 (2019-12-25 revision 647ee6f091) [x86_64-linux-gnu]

**Manifest location and content prior to update**
/Gemfile.lock - see https://github.com/jyn514/jyn514.github.io/blob/5e02d18696f849b0cc99287fa27843c158ce46f5/Gemfile.lock
**dependabot.yml content**
N/A
**Updated dependency**
nokogiri (1.10.4 to 1.13.1)
**What you expected to see, versus what you actually saw**
dependabot generates a PR that only changes the Gemfile. Instead, the PR modifies other files as well.
**Native package manager behavior**
N/A
**Images of the diff or a link to the PR, issue or logs**
https://github.com/jyn514/jyn514.github.io/pull/5

Contributor guide

Open the contributing guide

Research direction

Start with the linked pull request and the repository's Gemfile.lock, then reproduce the dependency update after the master branch is force-pushed. Compare the generated PR diff with the intended nokogiri update; done means the update PR handles the force-push without unexpectedly modifying unrelated files.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.