search

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.61k stars 981 forks source link

Not picking up changelog from ktlint-gradle #2638

Open ColtonIdle opened 3 years ago

ColtonIdle commented 3 years ago

Dependabot doesn't seem to show release notes for the following project even though it contains them

https://github.com/JLLeitschuh/ktlint-gradle/releases

JLLeitschuh commented 3 years ago

I came here to report a completely unrelated issue. Funny to see that this was the top issue opened here. 😆

jeffwidman commented 2 years ago

👋 Hey there! Sorry for the glacially slow response... we've been a bit buried the past few years, and only just now starting to dig through some of our backlog.

This issue is pretty old, and we've pushed a lot of bugfixes since then... is this still a valid / reproducible issue?

Also, this is a package metadata issue... we definitely aren't perfect in our code paths for fetching metadata, but across the ecosystems we support what we've found is that reasonably frequently the problem is the underlying dependency getting bumped publishes wrong metadata.

Anyway, if you're still seeing this let us know, otherwise we should close this.

jeffwidman commented 1 year ago

This is still a valid issue, easily repro'd by grep'ing github for "bump JLLeitschuh / ktlint-gradle" and looking at PR's... for example:

ColtonIdle commented 1 year ago

Hope they added more folks to your team to support the great work you all are doing! =)

deivid-rodriguez commented 1 year ago

I had a quick look at this and I see that we seem to be looking for the source repository at https://plugins.gradle.org/m2/org/jlleitschuh/gradle/ktlint/org.jlleitschuh.gradle.ktlint.gradle.plugin/11.0.0/org.jlleitschuh.gradle.ktlint.gradle.plugin-11.0.0.pom, but there's nothing about that in there. Do you know of any other plugins where the changelog is displayed fine? I do see the proper source repo at https://plugins.gradle.org/plugin/org.jlleitschuh.gradle.ktlint, but we should use something more consumable like a pom file.