npm & yarn doesn't follow semantic versioning in package.json

[koen-dev]

Steps to reproduce

1. Project with package.json that specifies dependency update type with minor release max for example: "jest": "^25.5.4"
2. Run kira-dependencies with PACKAGE_MANAGER_SET = npm

Expected result

1. kira-dependencies will only create merge requests for jest that have minor releases

Actual result

1. kira-dependencies creates a merge request for the major releases

Background

I'm not familiar with dependabot and I couldn't find anything about how to handle allowed updates for kira-dependencies. It is important for me that there are no merge requests for major releases as they may require code changes due to breaking changes.

[clement-michelet]

I can confirm that using both bump_versions and bump_versions_if_necessary

Following https://semver.npmjs.com/
With a requirement "@fullcalendar/timegrid": "^4.4.0" and version 4.4.0 installed, I expect the updated version to be 4.6.6, not 5.20.1.

Not sure if it's related to dependabot-core or update.rb repo

[GeekBeardLinks]

Can it be that Dependabot changed the value names? I found that that the available values are: off, auto, widen_ranges, increase_versions, increase_versions_if_necessary.

Source: https://dependabot.com/docs/config-file/#available-update-strategies

[clement-michelet]

Can it be that Dependabot changed the value names? I found that that the available values are: off, auto, widen_ranges, increase_versions, increase_versions_if_necessary.

Source: https://dependabot.com/docs/config-file/#available-update-strategies

@GeekBeardLinks

According to the source code used for resolving required updates here, the only possible values are widen_ranges, bump_versions and bump_versions_if_necessary

The documentation is about using dependabot as a service, not as a library

[cussiol]

I can confirm that this behavior also happens with bundler, with both bump_versions and bump_versions_if_necessary.

If there is a requirement such as gem 'ruby', '~> 5.2', '< 6', it will ignore < 6 and update Rails to 6.* (the latest always).

I usually close the unwanted merge requests, but for every new version, a new merge request is created.

[sobolevn]

I am pretty sure that this needs to be resolved in the dependabot's main repo.