rhyskoedijk
commented
3 months ago Hi, thanks for the solid reproduction info. I've done a step-through with your config and unfortunately it seems that this is an issue with dependabot-core itself:
From my understanding of the code; Exact dependency versions aren't resolved unless there is a package-lock.json; Without the exact dependency versions, Dependabot won't check your semver conditions.
From the comments in https://github.com/dependabot/dependabot-core/issues/9685, it sounds like this did work at one point, but regressed sometime around April 2024. There doesn't appear to be a fix available yet.
After adding a package-lock.json and changing versioning-strategy to lockfile-only, I got the behaviour I think you're expecting. This is the result when I tested tinymce:
2024/07/20 02:22:43 INFO <job_1721442159> Checking if tinymce 6.8.3 needs updating
2024/07/20 02:22:43 INFO <job_1721442159> Ignored versions:
2024/07/20 02:22:43 INFO <job_1721442159> version-update:semver-major - from
🌍 --> GET https://registry.npmjs.org/tinymce
🌍 <-- 200 https://registry.npmjs.org/tinymce
2024/07/20 02:22:44 INFO <job_1721442159> Filtered out 7 ignored versions
🌍 --> HEAD https://registry.npmjs.org/tinymce/-/tinymce-6.8.4.tgz
🌍 <-- 200 https://registry.npmjs.org/tinymce/-/tinymce-6.8.4.tgz
2024/07/20 02:22:44 INFO <job_1721442159> Latest version is 6.8.4
2024/07/20 02:22:44 INFO <job_1721442159> Filtered out 7 ignored versions
2024/07/20 02:22:44 INFO <job_1721442159> Requirements to unlock none
2024/07/20 02:22:44 INFO <job_1721442159> Requirements update strategy lockfile_only
2024/07/20 02:22:44 INFO <job_1721442159> Filtered out 7 ignored versions
2024/07/20 02:22:44 INFO <job_1721442159> Filtered out 7 ignored versions
2024/07/20 02:22:44 INFO <job_1721442159> Updating tinymce from 6.8.3 to 6.8.4
2024/07/20 02:22:45 INFO <job_1721442159> Submitting tinymce pull request for creation
2024/07/20 02:22:45 INFO <job_1721442159> Skipping pull request creation as it is disabled for this job.
2024/07/20 02:22:45 DEBUG <job_1721442159> Staged file changes were:
2024/07/20 02:22:45 DEBUG <job_1721442159> 🟡 updated 'package-lock.json' in '/WebAppAngular'
2024/07/20 02:22:45 INFO <job_1721442159> Finished job processing
2024/07/20 02:22:45 INFO Results:
+-------------------------------------------+
| Changes to Dependabot Pull Requests |
+---------+---------------------------------+
| created | tinymce ( from 6.8.3 to 6.8.4 ) |
+---------+---------------------------------+I don't think it is feasible to fix the issue in this project, it would need to be fixed in dependabot-core.
rdehouss
Describe the bug Context: npm (package.json, no package-lock.json)
With the vNext script (because I use groups that are not working with the "old" script) and also with normal script,
Does not have any effect. Although, in the console, I can clearly see that it's content is in the variable
DEPENDABOT_IGNORE_CONDITIONS:/usr/bin/docker run --rm -i -e DEPENDABOT_PACKAGE_MANAGER=npm -e DEPENDABOT_OPEN_PULL_REQUESTS_LIMIT=20 -e DEPENDABOT_DIRECTORY=/ -e DEPENDABOT_IGNORE_CONDITIONS=[{"dependency-name":"*","update-types":["version-update:semver-major"]}] -e DEPENDABOT_DEPENDENCY_GROUPS={"angular":{"patterns":["@angular*"]},"azure":{"patterns":["@azure*"]},"fullcalendar":{"patterns":["@fullcalendar*","fullcalendar"]},"mat-datetimepicker":{"patterns":["@mat-datetimepicker*"]},"ngx-translate":{"patterns":["@ngx-translate*"]},"moment":{"patterns":["moment*"]},"karma":{"patterns":["karma*"]}} -e DEPENDABOT_FAIL_ON_EXCEPTION=true -e DEPENDABOT_SKIP_PULL_REQUESTS=true -e AZURE_ORGANIZATION=*** -e AZURE_PROJECT=*** -e AZURE_REPOSITORY=*** -e AZURE_ACCESS_TOKEN=*** -e AZURE_MERGE_STRATEGY=squash ghcr.io/tinglesoftware/dependabot-updater-npm:1.30 update_script_vnextCategorization
Repository Private
To Reproduce Steps to reproduce the behavior:
skipPullRequests, it gives the same resultschedules:
pool: vmImage: 'ubuntu-latest' # requires macos or ubuntu (windows is not supported)
steps:
updates:
For all deps
ignore all major updates
update-types: ["version-update:semver-major"]
Actual result
Expected behavior npm-check-update returns me the following
It is expected to have PRs only for these versions, NOT the major ones, being:
Screenshots N/A
Extension (please complete the following information):
Server (please complete the following information):
Additional context N/A