dependabot / dependabot/dependabot-core

Support non-standard Gradle library catalog locations

Open
#8,079 4 comments 3 reactions 0 assignees View on GitHub
T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Hello!

The current documentation states that Dependabot will look at one and only one specific file when trying to update TOML-based library catalogs:

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#gradle

Specifically, it'll look at `gradle/libs.versions.toml`.

We put our dependency catalog file in a separate repository and share it between multiple repositories using a `git submodule`. We realistically can't put the catalog file where Dependabot expects to find it.

Any chance you could add a file parameter so that we could specify a custom location for our catalog file?

Contributor guide

Open the contributing guide

Research direction

Start with the Gradle configuration documentation linked in the issue and the current handling of gradle/libs.versions.toml. Trace how Dependabot discovers TOML-based library catalogs and how dependabot.yml options are parsed. Done means a repository can specify a non-standard catalog location, including the submodule arrangement described here, with documentation and coverage for the new option.

Written by the indexing model from the issue text.

Assessment

Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.