dependabot / dependabot/dependabot-core
Dependabot is not updating package-lock when bumping dependencies in a monorepo
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
npm
### Package manager version
npm 8.19.3
### Language version
node 16.19.0
### Manifest location and content before the Dependabot update
package.json
```json
{
"name": "@atos-parallel/web",
"private": "true",
"engines": {
"node": ">= 16.0.0",
"npm": ">= 8.0.0"
},
"workspaces": [
"packages/docs"
],
"scripts": {
},
"devDependencies": {
"@atos-parallel/release-config": "^1.2.3",
"@atos-parallel/stylelint-config": "^1.2.0",
"@babel/core": "^7.20.5",
"@commitlint/cli": "^17.3.0",
"@commitlint/config-conventional": "^17.3.0",
"@percy/cli": "^1.16.0",
"@typescript-eslint/eslint-plugin": "^5.47.0",
"@typescript-eslint/parser": "^5.47.0",
"autoprefixer": "^10.4.13",
"concurrently": "^7.6.0",
"cssnano": "^5.1.14",
"eslint": "^8.30.0",
"hint": "^7.1.3",
"husky": "^8.0.2",
"lint-staged": "^13.1.0",
"postcss": "^8.4.20",
"postcss-nesting": "^10.2.0",
"postcss-preset-env": "^7.8.3",
"prettier": "^2.8.1",
"pretty-quick": "^3.1.0",
"rimraf": "^3.0.2",
"typedoc": "^0.23.23",
"typedoc-plugin-markdown": "^3.14.0"
}
}
```
/packages/docs/package.json
```json
{
"name": "@atos-parallel/docs",
"version": "1.4.0",
"private": true,
"scripts": {
},
"dependencies": {
"@atos-parallel/icons": "^1.2.12",
"lit": "^2.5.0"
},
"devDependencies": {
"@babel/core": "^7.20.5",
"@percy/storybook": "^4.3.4",
"@storybook/addon-a11y": "^6.5.14",
"@storybook/addon-actions": "6.5.14",
"@storybook/addon-docs": "6.5.14",
"@storybook/addon-essentials": "6.5.14",
"@storybook/addon-links": "6.5.14",
"@storybook/addon-postcss": "^2.0.0",
"@storybook/addons": "6.5.14",
"@storybook/builder-vite": "^0.2.6",
"@storybook/theming": "6.5.14",
"@storybook/web-components": "6.5.14",
"babel-loader": "^9.1.0",
"postcss": "^8.4.20",
"storybook-addon-designs": "^6.3.1"
},
"peerDependencies": {
"@atos-parallel/components": "1.1.1"
}
}
```
### dependabot.yml content
```yaml
version: 2
registries:
github:
type: npm-registry
url: https://npm.pkg.github.com
token: ${{secrets.DEPENDABOT_TOKEN}}
updates:
- package-ecosystem: 'npm'
directory: '/' # Location of package manifests
registries: '*'
schedule:
interval: 'daily'
time: '00:00'
timezone: 'Europe/Berlin'
```
### Updated dependency
@storybook/builder-vite from 0.2.5 to 0.2.6
### What you expected to see, versus what you actually saw
Dependabot should update @storybook/builder-vite to version 0.2.6 in package.json in the 'docs' workspace and the package-lock.json in the root of the monorepo.
The package-lock.json is not updated though
### Native package manager behavior
package-lock.json in the root of the monorepo is updated too.
### Images of the diff or a link to the PR, issue, or logs

https://github.com/atos-parallel/web/pull/699
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.