dependabot / dependabot/dependabot-core

add support for bumping version of `packageManager` specified inside `package.json`

Open
#4,830 1 comment 82 reactions 0 assignees View on GitHub
Keep T: feature-request T: new-ecosystem
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

I'd like to be able to use `yarn` or `pnpm` as an alternative package manager. See docs: https://nodejs.org/api/corepack.html

To do so, they get configured in `package.json` under the `packageManager` field - with a version specified. e.g. `"packageManager": "yarn@1.22.15"`

It would be great if Dependabot could keep that version up to date - as currently it does not.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how Dependabot reads package.json dependency metadata and how its existing package-manager update support is organized; the issue provides the packageManager field format and Corepack documentation as the starting point. Done means a yarn@ or pnpm@ version in package.json is detected and kept up to date, with the relevant behavior covered by the project's existing tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.