dependabot / dependabot/dependabot-core

Dependabot is not updating package-lock when bumping dependencies in a monorepo

Open
#6,346 47 comments 16 reactions 1 assignee Claimed by @v-thavaahariharangit View on GitHub
F: monorepo 📦 L: javascript:npm T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

npm 8.19.3

### Language version

node 16.19.0

### Manifest location and content before the Dependabot update

package.json
```json
{
"name": "@atos-parallel/web",
"private": "true",
"engines": {
"node": ">= 16.0.0",
"npm": ">= 8.0.0"
},
"workspaces": [
"packages/docs"
],
"scripts": {
},
"devDependencies": {
"@atos-parallel/release-config": "^1.2.3",
"@atos-parallel/stylelint-config": "^1.2.0",
"@babel/core": "^7.20.5",
"@commitlint/cli": "^17.3.0",
"@commitlint/config-conventional": "^17.3.0",
"@percy/cli": "^1.16.0",
"@typescript-eslint/eslint-plugin": "^5.47.0",
"@typescript-eslint/parser": "^5.47.0",
"autoprefixer": "^10.4.13",
"concurrently": "^7.6.0",
"cssnano": "^5.1.14",
"eslint": "^8.30.0",
"hint": "^7.1.3",
"husky": "^8.0.2",
"lint-staged": "^13.1.0",
"postcss": "^8.4.20",
"postcss-nesting": "^10.2.0",
"postcss-preset-env": "^7.8.3",
"prettier": "^2.8.1",
"pretty-quick": "^3.1.0",
"rimraf": "^3.0.2",
"typedoc": "^0.23.23",
"typedoc-plugin-markdown": "^3.14.0"
}
}

```

/packages/docs/package.json

```json
{
"name": "@atos-parallel/docs",
"version": "1.4.0",
"private": true,
"scripts": {
},
"dependencies": {
"@atos-parallel/icons": "^1.2.12",
"lit": "^2.5.0"
},
"devDependencies": {
"@babel/core": "^7.20.5",
"@percy/storybook": "^4.3.4",
"@storybook/addon-a11y": "^6.5.14",
"@storybook/addon-actions": "6.5.14",
"@storybook/addon-docs": "6.5.14",
"@storybook/addon-essentials": "6.5.14",
"@storybook/addon-links": "6.5.14",
"@storybook/addon-postcss": "^2.0.0",
"@storybook/addons": "6.5.14",
"@storybook/builder-vite": "^0.2.6",
"@storybook/theming": "6.5.14",
"@storybook/web-components": "6.5.14",
"babel-loader": "^9.1.0",
"postcss": "^8.4.20",
"storybook-addon-designs": "^6.3.1"
},
"peerDependencies": {
"@atos-parallel/components": "1.1.1"
}
}

```

### dependabot.yml content

```yaml
version: 2

registries:
github:
type: npm-registry
url: https://npm.pkg.github.com
token: ${{secrets.DEPENDABOT_TOKEN}}

updates:
- package-ecosystem: 'npm'
directory: '/' # Location of package manifests
registries: '*'
schedule:
interval: 'daily'
time: '00:00'
timezone: 'Europe/Berlin'
```

### Updated dependency

@storybook/builder-vite from 0.2.5 to 0.2.6

### What you expected to see, versus what you actually saw

Dependabot should update @storybook/builder-vite to version 0.2.6 in package.json in the 'docs' workspace and the package-lock.json in the root of the monorepo.
The package-lock.json is not updated though

### Native package manager behavior

package-lock.json in the root of the monorepo is updated too.

### Images of the diff or a link to the PR, issue, or logs

![image](https://user-images.githubusercontent.com/5543595/208656997-ae51b9bc-e6ac-44d1-8bcb-0ff739982909.png)

https://github.com/atos-parallel/web/pull/699

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.