DOCSEARCHbyAlgolia
Submit Docs

dependabot-core

repository·main·Indexed 26 days ago

https://github.com/dependabot/dependabot-core

The engine behind Dependabot's dependency update capabilities, providing logic for version resolution, manifest generation, and changelog extraction. It includes APIs for dependency graphers, file fetchers, file parsers, file updaters, and metadata finders across multiple programming languages and configuration formats, including support for Bazel, Bun, Bundler, and Cargo.

Tokens
33.4K
Snippets
62
Records
281
Agent score
91%

What's inside dependabot-core

  1. Overview of Dependabot-Core

    main

    Dependabot-Core is the core library used by Dependabot to automate dependency updates. It provides the logic to check for the latest resolvable dependency versions, generate updated manifest and lockfiles, and create PR descriptions containing changelogs, release notes, and commits.

    Supported ecosystems include:

    • Ruby, JavaScript, Python, PHP, Dart, Elixir, Elm, Go, Rust, Java, Julia, and .NET
    • Git submodules, Docker files, Opentofu, Terraform files, and Pre-Commit hooks.

  6. Understand the Dependabot-Core architecture and package structure

    main

    Dependabot-Core is a collection of Ruby gems containing the logic for updating dependencies across various languages.

    dependabot-common

    Contains shared functionality, such as logic for handling Git dependencies and code for creating pull requests across different platforms. It also defines base classes for implementing language or package manager support.

    dependabot-{package-manager}

    Each supported package manager has its own gem. These gems implement a standard set of service classes:

    • FileFetcher: Fetches dependency files (e.g., Gemfile, Gemfile.lock).
    • FileParser: Parses dependency files to extract a list of dependencies.
    • UpdateChecker: Checks if a dependency is up-to-date.
    • FileUpdater: Updates a dependency file to the latest version.
    • MetadataFinder: Looks up dependency metadata (e.g., GitHub URL).
    • Version: Handles dependency version comparison logic.
    • Requirement: Handles dependency requirement formats (e.g., >= 1.2.3).

    dependabot-omnibus

    A meta-gem that depends on all other language-specific gems. Including this gem provides support for all supported languages automatically.

  7. Understand Julia support in Dependabot

    main
    This package enables Dependabot to manage Julia dependencies by parsing Project.toml and Manifest.toml files. It supports version resolution, semantic versioning, integration with the Julia General registry, and Julia workspace configurations (where multiple packages share a common manifest in a parent directory).

  9. Bazel ecosystem implementation status

    main

    The Bazel support for dependabot-core is currently under development. The implementation status of required and optional classes is as follows:

    Required Classes:

    • FileFetcher: Implemented
    • FileParser: Implemented
    • UpdateChecker: Implemented
    • FileUpdater: Implemented

    Optional Classes:

    • MetadataFinder: Not implemented
    • Version: Implemented
    • Requirement: Implemented

    Supporting Infrastructure:

    • Comprehensive unit tests: Implemented
    • CI/CD integration: Implemented
    • Documentation: Implemented

  11. Supported features in dependabot-deno

    main

    The dependabot-deno implementation currently supports the following Deno ecosystem features:

    • Manifests: deno.json and deno.jsonc import maps.
    • Specifiers: jsr: and npm: specifiers (including scoped, unscoped, versionless, and sub-path).
    • Lockfiles: deno.lock regeneration when the manifest changes.
    • Workspaces: Discovery of member deno.json/deno.jsonc manifests via the root workspace field, supporting glob patterns (e.g., ./packages/*) and ! negations.
    • Dependencies: Cooldown for direct dependencies.

  12. Simulate dependency updates with the CLI tool

    main

    To debug or simulate dependency update jobs within the development environment, you can use the Dependabot CLI.

    The CLI incorporates the GitHub Credentials Proxy to more accurately simulate how the Dependabot-at-GitHub service interacts with private registries. It also supports dropping into the Ruby debugger for deep inspection.