Is there an existing issue for this?
Feature description
I'm quite often in the situation that Dependabot cannot create a PR for patching a vulnerable dependency because the vulnerable dependency is a transient one and their parent dependency requires a smaller version than the patched one.
E.g. my package.json requires package A and A requires version ^1.2.0 of B. But B has a vulnerability that's addressed in version 2.0.0. Dependabot cannot create a PR here because ^1.2.0 doesn't allow major version steps.
Expected behavior so far.
What I do in 99% of the cases, is setting B in resolutions of my package.json file (using Yarn 4) to e.g. >=2.0.0.
But now let's say, in version 2.0.0 of B another vulnerability get detected and the patched version is 2.0.1.
Now the problem starts: Dependabot still cannot open a PR. And that's somewhat inconvenient.
Dependabot should detect that I'm already ignoring and overwriting A's requirement of version 1.2.0 of B and installing version 2.0.0 instead. So, A's requirement doesn't play a role anymore. Dependabot should look at what's actually installed. And that's version 2.0.0 of B. And since between 2.0.0 and 2.0.1, it's a only a "patch"-step, Dependabot should not have a problem creating a PR, changing resolutions of B from >=2.0.0 to >=2.0.1.
Relates to #9058
Is there an existing issue for this?
Feature description
I'm quite often in the situation that Dependabot cannot create a PR for patching a vulnerable dependency because the vulnerable dependency is a transient one and their parent dependency requires a smaller version than the patched one.
E.g. my package.json requires package A and A requires version
^1.2.0of B. But B has a vulnerability that's addressed in version2.0.0. Dependabot cannot create a PR here because^1.2.0doesn't allow major version steps.Expected behavior so far.
What I do in 99% of the cases, is setting B in
resolutionsof my package.json file (using Yarn 4) to e.g.>=2.0.0.But now let's say, in version
2.0.0of B another vulnerability get detected and the patched version is2.0.1.Now the problem starts: Dependabot still cannot open a PR. And that's somewhat inconvenient.
Dependabot should detect that I'm already ignoring and overwriting A's requirement of version
1.2.0of B and installing version2.0.0instead. So, A's requirement doesn't play a role anymore. Dependabot should look at what's actually installed. And that's version2.0.0of B. And since between2.0.0and2.0.1, it's a only a "patch"-step, Dependabot should not have a problem creating a PR, changingresolutionsof B from>=2.0.0to>=2.0.1.Relates to #9058