Skip to content

feat: Parse versions from metadata links #632

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

ppkarwasz
Copy link

@ppkarwasz ppkarwasz commented Jun 23, 2025

Dependabot PRs that update a single dependency include version details in the commit message introduction, e.g.,

"Bumps <dependency> from <prevVersion> to <newVersion>."

This is the format generated by the commit_message_intro method in Dependabot Core.

However, when multiple dependencies are updated in a single PR, this format isn't used, which limits the action’s ability to extract accurate version information.

This change improves version parsing for multi-dependency PRs by introducing two additional detection strategies:

  1. YAML metadata parsing Dependabot includes a YAML block in the commit message with structured details for each updated dependency:

    updated-dependencies:
    - dependency-name: commons-codec:commons-codec
      dependency-version: 1.18.0
      dependency-type: direct:production
      update-type: version-update:semver-minor
      dependency-group: non-breaking

    This is the most reliable and stable source for the new version of each dependency, though it does not include the previous version.

  2. Metadata links parsing In multi-dependency updates, Dependabot also appends “metadata links” with a format like:

    "Updates <dependencyName> from <prevVersion> to <newVersion>"

    These lines are generated bythe metadata_links method and provide both the old and new versions.

By combining these sources, the action now supports version parsing for PRs with multiple updated dependencies—broadening its coverage and improving reliability.

Closes #402

Dependabot PRs that update a **single** dependency include version details in the commit message introduction, e.g.,
> "Bumps `<dependency>` from `<prevVersion>` to `<newVersion>`"
This is the format generated by the [`commit_message_intro`](https://github.com/dependabot/dependabot-core/blob/cc4b4eaade37da0a19e0897e6897bab613064e74/common/lib/dependabot/pull_request_creator/message_builder.rb#L320-L325) method in Dependabot Core.

However, when **multiple dependencies** are updated in a single PR, this format isn't used consistently, which limits the action’s ability to extract accurate version information.

This change improves version parsing for multi-dependency PRs by introducing two additional detection strategies:

1. **YAML metadata parsing**
   Dependabot includes a YAML block in the commit message with structured details for each updated dependency:
   ```yaml
   updated-dependencies:
   - dependency-name: commons-codec:commons-codec
     dependency-version: 1.18.0
     dependency-type: direct:production
     update-type: version-update:semver-minor
     dependency-group: non-breaking
   ```
   This is the most reliable and stable source for the **new** version of each dependency, though it does **not** include the previous version.

2. **Metadata links parsing**
   In multi-dependency updates, Dependabot also appends “metadata links” with a format like:
   > "Updates `<dependencyName>` from `<prevVersion>` to `<newVersion>`"
     These lines are generated bythe [`metadata_links`](https://github.com/dependabot/dependabot-core/blob/cc4b4eaade37da0a19e0897e6897bab613064e74/common/lib/dependabot/pull_request_creator/message_builder.rb#L664-L678) method and provide **both** the old and new versions.

By combining these sources, the action now supports version parsing for PRs with multiple updated dependencies—broadening its coverage and improving reliability.

Closes dependabot#402
@ppkarwasz ppkarwasz requested a review from a team as a code owner June 23, 2025 21:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support newVersion and prevVersion for updates with multiple dependencies
1 participant