dependabot / dependabot/dependabot-core
Add update types for Cargo-style (in)compatible version upgrades
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Currently, the only options for `update-types` in `dependabot.yml` are "major", "minor", and "patch", all defined as per SemVer. However, Cargo (the Rust package manager) uses [a modified form of SemVer](https://doc.rust-lang.org/cargo/reference/resolver.html#semver-compatibility) in which "Versions are considered compatible if their left-most non-zero major/minor/patch component is the same." Thus, a version upgrade from v0.1.0 to v0.2.0 is considered "incompatible" even though, by typical SemVer standards, it is minor.
I therefore request that `ignore.update-types` and `groups.*.update-types` gain support for the options `cargo-compatible` and `cargo-incompatible` (just spitballing on the names) for ignoring/grouping (in)compatible version updates.
Contributor guide
Research direction
The issue names no implementation files or tests. Begin by locating parsing and update-type handling for dependabot.yml's ignore.update-types and groups.*.update-types, then trace Cargo/Rust version compatibility rules. Done means both keys accept cargo-compatible and cargo-incompatible and classify the corresponding updates consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby, rust
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100