npm & yarn doesn't follow semantic versioning in package.json about kira-dependencies HOT 5 OPEN

I can confirm that using both bump_versions and bump_versions_if_necessary

Following https://semver.npmjs.com/
With a requirement "@fullcalendar/timegrid": "^4.4.0" and version 4.4.0 installed, I expect the updated version to be 4.6.6, not 5.20.1.

Not sure if it's related to dependabot-core or update.rb repo

from kira-dependencies.

Can it be that Dependabot changed the value names? I found that that the available values are: off, auto, widen_ranges, increase_versions, increase_versions_if_necessary.

Source: https://dependabot.com/docs/config-file/#available-update-strategies

from kira-dependencies.

Can it be that Dependabot changed the value names? I found that that the available values are: off, auto, widen_ranges, increase_versions, increase_versions_if_necessary.

Source: https://dependabot.com/docs/config-file/#available-update-strategies

@GeekBeardLinks

According to the source code used for resolving required updates here, the only possible values are widen_ranges, bump_versions and bump_versions_if_necessary

The documentation is about using dependabot as a service, not as a library

from kira-dependencies.

I can confirm that this behavior also happens with bundler, with both bump_versions and bump_versions_if_necessary.

If there is a requirement such as gem 'ruby', '~> 5.2', '< 6', it will ignore < 6 and update Rails to 6.* (the latest always).

I usually close the unwanted merge requests, but for every new version, a new merge request is created.

from kira-dependencies.

I am pretty sure that this needs to be resolved in the dependabot's main repo.

from kira-dependencies.