dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.72k stars 1.02k forks source link

New commit message `---` as headline (used to be useful information) #9805

Closed christianhujer closed 5 months ago

christianhujer commented 5 months ago

Is there an existing issue for this?

Package ecosystem

Gradle

Package manager version

8.7

Language version

Java 21 / Kotlin

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
  - package-ecosystem: "gradle"
    directory: "/"
    schedule:
      interval: "daily"

Updated dependency

This appears to happen to all dependencies managed by Gradle. I saw this happening on the following examples:

The Pull Requests still had the correct title. But the commit message is no longer useful.

What you expected to see, versus what you actually saw

I expect the commit message from Dependabot to be something that in the headline mentions the dependency that's updated, the old version, and the new version. Something like this:

Bump io.cucumber:cucumber-spring from 7.17.0 to 7.18.0

What I actually saw was a commit message that omitted the Bump part of the commit message and therefore was only the following:

    ---
    updated-dependencies:
    - dependency-name: org.jetbrains.kotlin:kotlin-reflect
      dependency-type: direct:production
      update-type: version-update:semver-major
    ...

This leads to a history that shows only --- as the commit summary, which is not very helpful.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

I have not created an isolated test case yet. I will create one in a public repository, and to see whether it works, I will have to wait for Dependabot to pick it up.

christianhujer commented 5 months ago

Duplicate of https://github.com/dependabot/dependabot-core/issues/9784 (which I didn't see earlier)