Ignore option is ignored since update from 0.7.0 to 0.9.7
Summary
I'm using dependabot-standalone and upgraded from dependabot-gitlab 0.7.0 to 0.9.7 yesterday.
Background
I have the following config:
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
commit-message:
prefix: "deps(js)"
open-pull-requests-limit: 10
ignore:
- dependency-name: "bootstrap"
update-types: ["major"]
And I'm on bootstrap v4 with the following package.json (extract):
{
"dependencies": {
"bootstrap": "^4.1.0",
"bootstrap-vue": "^2.0.0-rc.11"
}
}
The yarn.lock has the following corresponding entries:
# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
# yarn lockfile v1
bootstrap-vue@^2.0.0-rc.11:
version "2.21.2"
resolved "https://registry.yarnpkg.com/bootstrap-vue/-/bootstrap-vue-2.21.2.tgz#ec38f66c3a2205becccddb6158a991d96509ed0b"
integrity sha512-0Exe+4MZysqhZNXIKf4TzkvXaupxh9EHsoCRez0o5Dc0J7rlafayOEwql63qXv74CgZO8E4U8ugRNJko1vMvNw==
dependencies:
"@nuxt/opencollective" "^0.3.2"
bootstrap ">=4.5.3 <5.0.0"
popper.js "^1.16.1"
portal-vue "^2.1.7"
vue-functional-data-merge "^3.1.0"
"bootstrap@>=4.5.3 <5.0.0", bootstrap@^4.1.0:
version "4.6.0"
resolved "https://registry.yarnpkg.com/bootstrap/-/bootstrap-4.6.0.tgz#97b9f29ac98f98dfa43bf7468262d84392552fd7"
integrity sha512-Io55IuQY3kydzHtbGvQya3H+KorS/M9rSNyfCGCg9WZ4pyT/lCxIlpJgG1GXW/PswzC84Tr2fBYi+7+jFVQQBw==
Old behavior (0.7.0)
Now, previously (with 0.7.0) all was fine:
Using Docker executor with image docker.io/andrcuns/dependabot-gitlab:0.7.0 ...
Pulling docker image docker.io/andrcuns/dependabot-gitlab:0.7.0 ...
...
[2021-09-08 07:03:40 +0000 tid=18vv] DEBUG: [xxx/xxx=>npm] Skipping bootstrap: 4.6.0 due to allow/ignore rules
[2021-09-08 07:03:40 +0000 tid=18vv] DEBUG: [xxx/xxx=>npm] Skipping bootstrap-vue: 2.21.2 due to allow/ignore rules
...
New behavior (0.9.7)
However, now (with 0.9.7) the ignore rules are suddenly ignored:
Using Docker executor with image docker.io/andrcuns/dependabot-gitlab:0.9.7 ...
Pulling docker image docker.io/andrcuns/dependabot-gitlab:0.9.7 ...
...
[2021-09-09 07:03:32 +0000 tid=18s2] INFO: [xxx/xxx=>npm] Fetching info for bootstrap
[2021-09-09 07:03:35 +0000 tid=18s2] INFO: [xxx/xxx=>npm] found version for update: bootstrap: 4.6.0 => 5.1.1
[2021-09-09 07:03:38 +0000 tid=18s2] INFO: [xxx/xxx=>npm] Fetching info for bootstrap-vue
[2021-09-09 07:03:38 +0000 tid=18s2] INFO: [xxx/xxx=>npm] bootstrap-vue: 2.21.2 is up to date
Exceptation
bootstrap 5 should be ignored, because
- the ignore rule should prevent major updates, and
-
bootstrap-vuerequiresbootstrap@>=4.5.3 <5.0.0(seeyarn.lockexcerpt).