1

I'm trying to stay one minor version behind the latest python version, and I was hoping to use dependabot to help with that.

I'm using the python slim docker image as my base image, and based on that plus the dependabot docs I've added the following to my dependabot.yml:

- package-ecosystem: "docker"
directory: "/"
schedule:
  interval: "daily"
ignore:
  - dependency-name: "python"
    versions: [ "3.10.x" ]

This is not working. When I tell the 3.10 PR to "ignore this minor version", however, it does so successfully and states that it won't bother me about 3.10.x versions anymore, so clearly the logic is in there somewhere

ChickenWing
  • 639
  • 9
  • 24

1 Answers1

1

It is using Gem::Requirement here: https://github.com/dependabot/dependabot-core/blob/c0945b376ef12f3551e22f185dc6f20c56049296/docker/lib/dependabot/docker/requirement.rb#L8

I haven't tested this specific scenario, but I am using something similar with success. I think this will work:

ignore:
  - dependency-name: "python"
    versions: ["~> 3.10", "< 3.11"]

It appears to anyway, when testing against Gem::Requirement:

>> r = Gem::Requirement.new("~> 3.10", "< 3.11")
=> Gem::Requirement.new(["~> 3.10", "< 3.11"])
>> r.satisfied_by?(Gem::Version.new('3.11'))
=> false
>> r.satisfied_by?(Gem::Version.new('3.10'))
=> true
>> r.satisfied_by?(Gem::Version.new('3.10.1'))
=> true
Lucien Davison
  • 176
  • 1
  • 4