dependabot / dependabot/dependabot-core
libs.toml doesn't mean the dependency is used!
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
gradle
### Package manager version
8.4
### Language version
_No response_
### Manifest location and content before the Dependabot update
`/gradle/libs.toml`
### dependabot.yml content
```yaml
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
version: 2
updates:
- package-ecosystem: "gradle"
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
- package-ecosystem: "npm"
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
```
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
given
```toml
dgs-platform = "com.netflix.graphql.dgs:graphql-dgs-platform-dependencies:4.+"
```
when no reference to `libs.dgs.platform` in any `build.gradle*` or `*gradle.lockfile` exists
then this dependency doesn't need to be updated because it *isn't* used.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
https://github.com/xenoterracide/ai-wh40k/pull/33
### Smallest manifest that reproduces the issue
```toml
dgs-platform = "com.netflix.graphql.dgs:graphql-dgs-platform-dependencies:4.+"
```
Contributor guide
Research direction
Start with the smallest `/gradle/libs.toml` reproducer and the Gradle entry in `dependabot.yml`, then inspect the linked pull request for context. Trace how Dependabot determines which version-catalog aliases are used. Done means an unused alias such as `dgs-platform` does not generate an update while referenced aliases still do.
Written by the indexing model from the issue text.
Assessment
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100