dependabot / dependabot/dependabot-core
add support for bumping version of `packageManager` specified inside `package.json`
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
I'd like to be able to use `yarn` or `pnpm` as an alternative package manager. See docs: https://nodejs.org/api/corepack.html
To do so, they get configured in `package.json` under the `packageManager` field - with a version specified. e.g. `"packageManager": "yarn@1.22.15"`
It would be great if Dependabot could keep that version up to date - as currently it does not.
Contributor guide
Research direction
Start by tracing how Dependabot reads package.json dependency metadata and how its existing package-manager update support is organized; the issue provides the packageManager field format and Corepack documentation as the starting point. Done means a yarn@ or pnpm@ version in package.json is detected and kept up to date, with the relevant behavior covered by the project's existing tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100