dependabot / dependabot/dependabot-core

libs.toml doesn't mean the dependency is used!

Open
#8,205 2 comments 0 reactions 0 assignees View on GitHub
T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

gradle

### Package manager version

8.4

### Language version

_No response_

### Manifest location and content before the Dependabot update

`/gradle/libs.toml`

### dependabot.yml content

```yaml
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

version: 2
updates:
- package-ecosystem: "gradle"
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
- package-ecosystem: "npm"
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

given

```toml
dgs-platform = "com.netflix.graphql.dgs:graphql-dgs-platform-dependencies:4.+"
```

when no reference to `libs.dgs.platform` in any `build.gradle*` or `*gradle.lockfile` exists
then this dependency doesn't need to be updated because it *isn't* used.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

https://github.com/xenoterracide/ai-wh40k/pull/33

### Smallest manifest that reproduces the issue

```toml
dgs-platform = "com.netflix.graphql.dgs:graphql-dgs-platform-dependencies:4.+"
```

Contributor guide

Open the contributing guide

Research direction

Start with the smallest `/gradle/libs.toml` reproducer and the Gradle entry in `dependabot.yml`, then inspect the linked pull request for context. Trace how Dependabot determines which version-catalog aliases are used. Done means an unused alias such as `dgs-platform` does not generate an update while referenced aliases still do.

Written by the indexing model from the issue text.

Assessment

Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.