dependabot / dependabot/dependabot-core

Dependabot doesn't update to latest pre-release version

Open
#6,741 6 comments 2 reactions 0 assignees View on GitHub
L: javascript:yarn T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

Yarn (npm)

### Package manager version

Yarn `1.22.19` (npm `8.19.3`)

### Language version

Node.js `18.12.1`

### Manifest location and content before the Dependabot update

- `/package.json`
- `/yarn.lock`

### dependabot.yml content

_No response_

### Updated dependency

Dependency: `@myorg/react-scripts` (the actual organization has been replaced in this example)
Version from: `5.0.0-fork.1.0.3`
Version to: `5.0.1-fork.1.0.3`

### What you expected to see, versus what you actually saw

**Background:**

We've forked the [create-react-app](https://github.com/facebook/create-react-app) repository and have built a custom version of the `react-scripts` library. Thus, we've versioned the fork using the following pre-release version format: `-fork.`. The version format adheres to the [Semantic Versioning 2.0.0](https://semver.org/#spec-item-9) specification and based on the [precedence rules](https://semver.org/#spec-item-11) `5.0.0-fork.1.0.3 < 5.0.1-fork.1.0.3`.

Dependabot has previously updated successfully, e.g., from version `5.0.0-fork.1.0.2` to version `5.0.0-fork.1.0.3`.

Here's a comment that seems to describe a similar problem: https://github.com/dependabot/dependabot-core/issues/2250#issuecomment-1225855482

**Expected behavior:**

Dependabot updates `@myorg/react-scripts` from version `5.0.0-fork.1.0.3` to version `5.0.1-fork.1.0.3`.

**Actual behavior:**

Dependabot reports `No update needed for @myorg/react-scripts 5.0.0-fork.1.0.3`

### Native package manager behavior

Running `yarn upgrade-interactive --latest` suggests to update `@myorg/react-scripts` from version `5.0.0-fork.1.0.3` to version `5.0.1-fork.1.0.3`.

### Images of the diff or a link to the PR, issue, or logs

Dependabot logs related to the dependency:
```
updater | INFO Checking if @myorg/react-scripts 5.0.0-fork.1.0.3 needs updating
proxy | 2023/02/26 04:21:47 [202] GET https://my-private-registry.org:443/repository/npm-hosted/@myorg%2Freact-scripts
proxy | 2023/02/26 04:21:47 [202] * authenticating npm registry request (host: my-private-registry.org, basic auth)
proxy | 2023/02/26 04:21:48 [202] 200 https://my-private-registry.org:443/repository/npm-hosted/@myorg%2Freact-scripts
proxy | 2023/02/26 04:21:48 [204] GET https://my-private-registry.org:443/repository/npm-hosted/@myorg%2Freact-scripts/5.0.0-fork.1.0.3
proxy | 2023/02/26 04:21:48 [204] * authenticating npm registry request (host: my-private-registry.org, basic auth)
proxy | 2023/02/26 04:21:48 [204] 400 https://my-private-registry.org:443/repository/npm-hosted/@myorg%2Freact-scripts/5.0.0-fork.1.0.3
updater | INFO Latest version is 5.0.0-fork.1.0.3
updater | INFO No update needed for @myorg/react-scripts 5.0.0-fork.1.0.3
```

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the dependency entry in /package.json and /yarn.lock, then compare Dependabot's logged version check with Yarn's `upgrade-interactive --latest` result for @myorg/react-scripts. Reproduce the pre-release comparison using the versions in the report and inspect the package-manager update path. Done means Dependabot recognizes 5.0.1-fork.1.0.3 as newer than 5.0.0-fork.1.0.3.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js, react
Domain
build-system, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.