dependabot / dependabot/dependabot-core

Grouped update with one commit per dependency in a single PR

Open
#8,450 2 comments 19 reactions 0 assignees View on GitHub
F: grouped-updates 🎳 Stale T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

The functionality for grouped updates is very nice! Would it be possible to, instead of creating a single PR consisting of a single commit updating all the dependencies, create a single PR consisting of one commit per updated dependency?

Then we would have these different configuration options:

**No grouping** (possible today)
- PR: `Bump friendsofphp/php-cs-fixer from 3.34.1 to 3.37.0`
- Commit: `Bump friendsofphp/php-cs-fixer from 3.34.1 to 3.37.0`
- PR: `Bump phpstan/phpstan from 1.10.38 to 1.10.39`
- Commit: `Bump phpstan/phpstan from 1.10.38 to 1.10.39`

**Grouping with single commit** (possible today)
- PR: `Bump the dev-dependencies group with 2 updates`
- Commit: `Bump the dev-dependencies group with 2 updates`

**Grouping with individual commits** (the requested feature)
- PR: `Bump the dev-dependencies group with 2 updates`
- Commit: `Bump friendsofphp/php-cs-fixer from 3.34.1 to 3.37.0`
- Commit: `Bump phpstan/phpstan from 1.10.38 to 1.10.39`

I think this would give the best of both worlds:
- Fewer PRs (less noise, fewer rebases, lower build cost)
- Explicit commit messages, showing the dependency name and version
- More granular history, allowing to find the exact dependency that introduced an issue using tools like `git bisect`

For dependencies that must be updated together, they must of course be combined in a commit, just as they are without grouping.

Contributor guide

Open the contributing guide

Research direction

Use the requested behavior as the specification and trace how grouped updates create a pull request and its commits. Confirm how dependencies that must update together are identified. Done means one grouped PR contains separate commits for independent dependencies while coupled dependencies remain in a shared commit.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.