dependabot / dependabot/dependabot-core

Dependabot doesn't update dependency in `pyproject.toml` if it already satisfies the requirement

Open
#9,105 3 comments 9 reactions 0 assignees View on GitHub
T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

Python / pip

### Package manager version

24.0

### Language version

Python 3.10

### Manifest location and content before the Dependabot update

`pyproject.toml`:

```toml
# [..]
dependencies = ["my-package~=6.5"]
# [..]
```

### dependabot.yml content

```yaml
# [..]
versioning-strategy: increase
# [..]
```

### Updated dependency

`my-package` from `6.5.9` to `6.6.0`

### What you expected to see, versus what you actually saw

What I see: Dependabot doesn't update `my-package`
What I expect: Dependabot updates `my-package` from `my-package~=6.5` to `my-package~=6.6`

I've dug into the code and I think the issue comes from [this line](https://github.com/dependabot/dependabot-core/blob/main/python/lib/dependabot/python/update_checker/requirements_updater.rb#L82) in `updated_pyproject_requirement`:

```ruby
return req if new_version_satisfies?(req) && !has_lockfile
```

Here we're returning the requirement "as-is" because the new version already satisfies it, but this by-passes the setting `versioning-strategy: increase`. Instead, we should execute [this line](https://github.com/dependabot/dependabot-core/blob/main/python/lib/dependabot/python/update_checker/requirements_updater.rb#L93) from the same function:

```ruby
when :bump_versions then update_pyproject_version(req)
```

I've tested it and `update_pyproject_version(req)` returns the right value: `{:requirement=>"~=6.6", :file=>"pyproject.toml", :source=>nil, :groups=>[nil]}`

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in python/lib/dependabot/python/update_checker/requirements_updater.rb, especially updated_pyproject_requirement and the versioning-strategy branch described in the issue. Reproduce the pyproject.toml case with my-package~=6.5 and versioning-strategy: increase, then verify the generated requirement changes to ~=6.6 without affecting cases where the existing requirement should remain unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, ruby
Domain
devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.