dependabot / dependabot/dependabot-core

[Request] Annotate/comment to indicate added transitive dependencies.

Open
#9,068 1 comment 8 reactions 0 assignees View on GitHub
L: dotnet:nuget T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

As suggested by a user, new NuGet dependencies that are added to a `.csproj`, etc. could be annotated with a comment to indicate that the transitive dependency was added to allow the package upgrade and that at some point in the future it is a candidate to be manually removed.

Contributor guide

Open the contributing guide

Research direction

Start by locating the NuGet and .csproj update-generation code in dependabot-core, then inspect how newly added transitive dependencies are represented. Done means added transitive dependencies are annotated with a comment explaining why they were added and that they may be manually removed later.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
build-system, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.