dependabot / dependabot/dependabot-core
Dependabot doesn't update to latest pre-release version
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
Yarn (npm)
### Package manager version
Yarn `1.22.19` (npm `8.19.3`)
### Language version
Node.js `18.12.1`
### Manifest location and content before the Dependabot update
- `/package.json`
- `/yarn.lock`
### dependabot.yml content
_No response_
### Updated dependency
Dependency: `@myorg/react-scripts` (the actual organization has been replaced in this example)
Version from: `5.0.0-fork.1.0.3`
Version to: `5.0.1-fork.1.0.3`
### What you expected to see, versus what you actually saw
**Background:**
We've forked the [create-react-app](https://github.com/facebook/create-react-app) repository and have built a custom version of the `react-scripts` library. Thus, we've versioned the fork using the following pre-release version format: `-fork.`. The version format adheres to the [Semantic Versioning 2.0.0](https://semver.org/#spec-item-9) specification and based on the [precedence rules](https://semver.org/#spec-item-11) `5.0.0-fork.1.0.3 < 5.0.1-fork.1.0.3`.
Dependabot has previously updated successfully, e.g., from version `5.0.0-fork.1.0.2` to version `5.0.0-fork.1.0.3`.
Here's a comment that seems to describe a similar problem: https://github.com/dependabot/dependabot-core/issues/2250#issuecomment-1225855482
**Expected behavior:**
Dependabot updates `@myorg/react-scripts` from version `5.0.0-fork.1.0.3` to version `5.0.1-fork.1.0.3`.
**Actual behavior:**
Dependabot reports `No update needed for @myorg/react-scripts 5.0.0-fork.1.0.3`
### Native package manager behavior
Running `yarn upgrade-interactive --latest` suggests to update `@myorg/react-scripts` from version `5.0.0-fork.1.0.3` to version `5.0.1-fork.1.0.3`.
### Images of the diff or a link to the PR, issue, or logs
Dependabot logs related to the dependency:
```
updater | INFO Checking if @myorg/react-scripts 5.0.0-fork.1.0.3 needs updating
proxy | 2023/02/26 04:21:47 [202] GET https://my-private-registry.org:443/repository/npm-hosted/@myorg%2Freact-scripts
proxy | 2023/02/26 04:21:47 [202] * authenticating npm registry request (host: my-private-registry.org, basic auth)
proxy | 2023/02/26 04:21:48 [202] 200 https://my-private-registry.org:443/repository/npm-hosted/@myorg%2Freact-scripts
proxy | 2023/02/26 04:21:48 [204] GET https://my-private-registry.org:443/repository/npm-hosted/@myorg%2Freact-scripts/5.0.0-fork.1.0.3
proxy | 2023/02/26 04:21:48 [204] * authenticating npm registry request (host: my-private-registry.org, basic auth)
proxy | 2023/02/26 04:21:48 [204] 400 https://my-private-registry.org:443/repository/npm-hosted/@myorg%2Freact-scripts/5.0.0-fork.1.0.3
updater | INFO Latest version is 5.0.0-fork.1.0.3
updater | INFO No update needed for @myorg/react-scripts 5.0.0-fork.1.0.3
```
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start with the dependency entry in /package.json and /yarn.lock, then compare Dependabot's logged version check with Yarn's `upgrade-interactive --latest` result for @myorg/react-scripts. Reproduce the pre-release comparison using the versions in the report and inspect the package-manager update path. Done means Dependabot recognizes 5.0.1-fork.1.0.3 as newer than 5.0.0-fork.1.0.3.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js, react
- Domain
- build-system, devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100