dependabot / dependabot/dependabot-core

Add update types for Cargo-style (in)compatible version upgrades

Open
#9,681 2 comments 0 reactions 0 assignees View on GitHub
L: go:modules L: rust:cargo T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Currently, the only options for `update-types` in `dependabot.yml` are "major", "minor", and "patch", all defined as per SemVer. However, Cargo (the Rust package manager) uses [a modified form of SemVer](https://doc.rust-lang.org/cargo/reference/resolver.html#semver-compatibility) in which "Versions are considered compatible if their left-most non-zero major/minor/patch component is the same." Thus, a version upgrade from v0.1.0 to v0.2.0 is considered "incompatible" even though, by typical SemVer standards, it is minor.

I therefore request that `ignore.update-types` and `groups.*.update-types` gain support for the options `cargo-compatible` and `cargo-incompatible` (just spitballing on the names) for ignoring/grouping (in)compatible version updates.

Contributor guide

Open the contributing guide

Research direction

The issue names no implementation files or tests. Begin by locating parsing and update-type handling for dependabot.yml's ignore.update-types and groups.*.update-types, then trace Cargo/Rust version compatibility rules. Done means both keys accept cargo-compatible and cargo-incompatible and classify the corresponding updates consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby, rust
Domain
tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.