Not updating package.json about dependabot-core

[greysteil]

We haven't changed this for quite a while, but the logic is non-trivial, so it might just be that you're hitting a different path.

For apps (which we identify by checking they're not listed on npm) we update the requirement in the package.json unless the requirement is a range that is still satisfied. (If you're setting ranges in your package.json then we think it's unlikely you want them updating for in-range updates.)

For libraries (whose description in the package.json matches the description on npm) we only update the requirement in the package.json if the update is out of range. The assumption there is that library maintainers would want to keep their supported version ranges wide, in case they have integrators using --flat.

What's the repo you're seeing this behaviour on, and the thinking behind updating the package.json?

Thanks for the feedback!

[severen]

This is the repository.

The last commit from Dependabot to update package.json was severen/disposition@e950db75c3f5cd02985791c93c780727b631a125. So it seems this behavior has been going on for a while now and I've just not noticed. Either way it would be nice if there was an option for it.

[greysteil]

Thanks for the link - looks like Dependabot is definitely picking that up as a library, hence the update behaviour.

Can you give me a bit more detail on why you'd like updates to always affect the package.json? I can look into adding a setting for this, but it would really help to know why it would be useful.