dependabot / dependabot/dependabot-core
Dependabot assigned a package to a group after a group with a matching pattern
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 156
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
npm
### Package manager version
pnpm 9.0.6
### Language version
node 20.12.0
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
https://github.com/vlach-cookbook/cookbook/blob/9fa58c8843b73345b7e4598c3e5fc679e1f7e6cd/.github/dependabot.yml
```
groups:
astro:
patterns: ["astro", "@astrojs/*", "vitest"]
update-types: [patch, minor, major]
prisma:
patterns: ["prisma", "@prisma/*"]
update-types: [patch, minor, major]
playwright:
# This will usually fail, because the version in workflows and Dockerfiles
# has to match exactly.
patterns: ["@playwright/*"]
update-types: [patch, minor, major]
minors:
patterns: ["*"]
update-types: [patch, minor]
```
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
https://github.com/vlach-cookbook/cookbook/pull/108 is for the 'minors' group, but it includes updates to `@astrojs/solid-js` and `@playwright/test` which should be matched by the `@astrojs/*` and `@playwright/*` globs for earlier groups. The documentation says [updates should be assigned to the first group they match](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups:~:text=If%20a%20dependency%20update%20could%20belong%20to%20more%20than%20one%20group%2C%20it%20is%20only%20assigned%20to%20the%20first%20group%20it%20matches%20with.).
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.