dependabot / dependabot/dependabot-core
Dependabot doesn't update dependency in `pyproject.toml` if it already satisfies the requirement
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
Python / pip
### Package manager version
24.0
### Language version
Python 3.10
### Manifest location and content before the Dependabot update
`pyproject.toml`:
```toml
# [..]
dependencies = ["my-package~=6.5"]
# [..]
```
### dependabot.yml content
```yaml
# [..]
versioning-strategy: increase
# [..]
```
### Updated dependency
`my-package` from `6.5.9` to `6.6.0`
### What you expected to see, versus what you actually saw
What I see: Dependabot doesn't update `my-package`
What I expect: Dependabot updates `my-package` from `my-package~=6.5` to `my-package~=6.6`
I've dug into the code and I think the issue comes from [this line](https://github.com/dependabot/dependabot-core/blob/main/python/lib/dependabot/python/update_checker/requirements_updater.rb#L82) in `updated_pyproject_requirement`:
```ruby
return req if new_version_satisfies?(req) && !has_lockfile
```
Here we're returning the requirement "as-is" because the new version already satisfies it, but this by-passes the setting `versioning-strategy: increase`. Instead, we should execute [this line](https://github.com/dependabot/dependabot-core/blob/main/python/lib/dependabot/python/update_checker/requirements_updater.rb#L93) from the same function:
```ruby
when :bump_versions then update_pyproject_version(req)
```
I've tested it and `update_pyproject_version(req)` returns the right value: `{:requirement=>"~=6.6", :file=>"pyproject.toml", :source=>nil, :groups=>[nil]}`
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start in python/lib/dependabot/python/update_checker/requirements_updater.rb, especially updated_pyproject_requirement and the versioning-strategy branch described in the issue. Reproduce the pyproject.toml case with my-package~=6.5 and versioning-strategy: increase, then verify the generated requirement changes to ~=6.6 without affecting cases where the existing requirement should remain unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, ruby
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100