dependabot / dependabot/dependabot-core
[Request] Annotate/comment to indicate added transitive dependencies.
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
As suggested by a user, new NuGet dependencies that are added to a `.csproj`, etc. could be annotated with a comment to indicate that the transitive dependency was added to allow the package upgrade and that at some point in the future it is a candidate to be manually removed.
Contributor guide
Research direction
Start by locating the NuGet and .csproj update-generation code in dependabot-core, then inspect how newly added transitive dependencies are represented. Done means added transitive dependencies are annotated with a comment explaining why they were added and that they may be manually removed later.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- build-system, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100