From 3482afa2c5255bd748740fce81491f9ea48fd8d7 Mon Sep 17 00:00:00 2001 From: mchammer01 <42146119+mchammer01@users.noreply.github.com> Date: Tue, 26 Jan 2021 16:05:07 +0000 Subject: [PATCH 01/10] update table --- .../dependabot/supported-package-managers.md | 62 ++++++++++--------- 1 file changed, 32 insertions(+), 30 deletions(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 7ad0bf0e8e..9ef19f099d 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -1,34 +1,36 @@ -The following table shows, for each package manager, whether {% data variables.product.prodname_dependabot %} supports: dependencies in private {% data variables.product.prodname_dotcom %} repositories, and vendored dependencies. +The following table shows, for each package manager: +- the YAML value to use in the file, +- the supported versions, +- whether dependencies in private {% data variables.product.prodname_dotcom %} repositories are supported +- whether vendoring is supported for the dependency -Package manager | Private {% data variables.product.prodname_dotcom %} repositories | Vendoring ---- | :---:| :---: -Bundler: `bundler` | | **✓** | -Cargo: `cargo` | **✓** | | -Composer: `composer` | **✓** | | -Docker: `docker` | **✓** | | -Elixir: `hex` | | | -Elm: `elm` | **✓** | | -git submodule: `gitsubmodule` | **✓** | | -GitHub Actions: `github-actions` | **✓** | | -Go modules: `gomod` | **✓** | **✓** | -Gradle: `gradle` | **✓** | | -Maven: `maven` | **✓** | | -Mix: `mix` | **✓** | | -npm: `npm` | **✓** | | -NuGet: `nuget` | **✓** | | -pip: `pip` | | | -Terraform: `terraform` | **✓** | | - -{% note %} - -**Note**: {% data variables.product.prodname_dependabot %} also supports the following package managers: - --`yarn` (v1 only) (specify `npm`) - --`.gradle.kts` files, for Kotlin projects (specify `gradle`) - --`pipenv`, `pip-compile`, and `poetry` (specify `pip`) +Package manager | YAML value | Supported versions | Private {% data variables.product.prodname_dotcom %} repositories | Vendoring +--- | :---:| :---:|:---:|:---: +Bundler | `bundler` | v1 | | **✓** | +Cargo | `cargo` | v1 | **✓** | | +Composer | `composer` | v1,v2 | **✓** | | +Docker | `docker` | v1 | **✓** | | +Elixir | `hex` | TBD | | | +Elm | `elm` | v0.18, v0.19 | **✓** | | +git submodule | `gitsubmodule` | N/A (no version) | **✓** | | +GitHub Actions | `github-actions` | N/A (no version) | **✓** | | +Go modules | `gomod` | v1 | **✓** | **✓** | +Gradle | `gradle` | see (A) below | **✓** | | +Maven | `maven` | see (B) below | **✓** | | +Mix | `mix` | v1 | **✓** | | +npm | `npm` | v6 | **✓** | | +NuGet | `nuget` | <= 4.8. See (C) below | **✓** | | +pip | `pip` | v20 | | | +pipenv | `pip` | <= 2018.11.26 | | | +pip-compile | `pip` | TBD | | | +poetry | `pip` | TBD | | | +Terraform | `terraform` | <= 0.11 | **✓** | | +yarn | `nmp` | v1 | | | For example, if you use `poetry` to manage your Python dependencies and want {% data variables.product.prodname_dependabot %} to monitor your dependency manifest file for new versions, use `package-ecosystem: "pip"` in your *dependabot.yml* file. -{% endnote %} +(A) {% data variables.product.prodname_dependabot %} doesn't run Gradle (therefore doesn't really support a version of Gradle), but {% data variables.product.prodname_dependabot %} supports updates to the following files: `build.gradle` and `build.gradle.kts` (Kotlin projects). + +(B) {% data variables.product.prodname_dependabot %} doesn't run Maven (therefore doesn't really support a version of Maven), but {% data variables.product.prodname_dependabot %} supports updates to `pom.xml` files. + +(C) {% data variables.product.prodname_dependabot %} doesn't run the NuGet cli (therefore doesn't really support a version of NuGet) but does support most features up until 4.8, as 4.9 introduces lockfiles which are unsupported. From 70f5aa23e95e5b568729e69438ff4d6e30a9c6b7 Mon Sep 17 00:00:00 2001 From: mchammer01 <42146119+mchammer01@users.noreply.github.com> Date: Thu, 28 Jan 2021 08:26:08 +0000 Subject: [PATCH 02/10] tidying up --- .../dependabot/supported-package-managers.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 9ef19f099d..c6232f8b46 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -1,8 +1,8 @@ The following table shows, for each package manager: -- the YAML value to use in the file, -- the supported versions, -- whether dependencies in private {% data variables.product.prodname_dotcom %} repositories are supported -- whether vendoring is supported for the dependency +- The YAML value to use in the*dependabot.yml* file +- The supported versions +- Whether dependencies in private {% data variables.product.prodname_dotcom %} repositories are supported +- Whether vendoring is supported for the package Package manager | YAML value | Supported versions | Private {% data variables.product.prodname_dotcom %} repositories | Vendoring --- | :---:| :---:|:---:|:---: @@ -27,10 +27,10 @@ poetry | `pip` | TBD | | | Terraform | `terraform` | <= 0.11 | **✓** | | yarn | `nmp` | v1 | | | -For example, if you use `poetry` to manage your Python dependencies and want {% data variables.product.prodname_dependabot %} to monitor your dependency manifest file for new versions, use `package-ecosystem: "pip"` in your *dependabot.yml* file. +(A) {% data variables.product.prodname_dependabot %} doesn't run Gradle but supports updates to the following files: `build.gradle` and `build.gradle.kts` (for Kotlin projects). -(A) {% data variables.product.prodname_dependabot %} doesn't run Gradle (therefore doesn't really support a version of Gradle), but {% data variables.product.prodname_dependabot %} supports updates to the following files: `build.gradle` and `build.gradle.kts` (Kotlin projects). +(B) {% data variables.product.prodname_dependabot %} doesn't run Maven but supports updates to `pom.xml` files. -(B) {% data variables.product.prodname_dependabot %} doesn't run Maven (therefore doesn't really support a version of Maven), but {% data variables.product.prodname_dependabot %} supports updates to `pom.xml` files. +(C) {% data variables.product.prodname_dependabot %} doesn't run the NuGet CLI but does support most features up until version 4.8. Version 4.9 introduces lockfiles, which are unsupported. -(C) {% data variables.product.prodname_dependabot %} doesn't run the NuGet cli (therefore doesn't really support a version of NuGet) but does support most features up until 4.8, as 4.9 introduces lockfiles which are unsupported. +For package managers such as `pipenv` and `poetry`, you need to use the pip YAML value.For example, if you use `poetry` to manage your Python dependencies and want {% data variables.product.prodname_dependabot %} to monitor your dependency manifest file for new versions, use `package-ecosystem: "pip"` in your *dependabot.yml* file. From 3a8e6ed426e625645618ce1e5dba7aa9a53b2692 Mon Sep 17 00:00:00 2001 From: mchammer01 <42146119+mchammer01@users.noreply.github.com> Date: Thu, 28 Jan 2021 08:39:11 +0000 Subject: [PATCH 03/10] fix a few things --- data/reusables/dependabot/supported-package-managers.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index c6232f8b46..ecc378d05f 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -1,5 +1,5 @@ The following table shows, for each package manager: -- The YAML value to use in the*dependabot.yml* file +- The YAML value to use in the *dependabot.yml* file - The supported versions - Whether dependencies in private {% data variables.product.prodname_dotcom %} repositories are supported - Whether vendoring is supported for the package @@ -19,7 +19,7 @@ Gradle | `gradle` | see (A) below | **✓** | | Maven | `maven` | see (B) below | **✓** | | Mix | `mix` | v1 | **✓** | | npm | `npm` | v6 | **✓** | | -NuGet | `nuget` | <= 4.8. See (C) below | **✓** | | +NuGet | `nuget` | <= 4.8.
See (C) below | **✓** | | pip | `pip` | v20 | | | pipenv | `pip` | <= 2018.11.26 | | | pip-compile | `pip` | TBD | | | @@ -33,4 +33,4 @@ yarn | `nmp` | v1 | | | (C) {% data variables.product.prodname_dependabot %} doesn't run the NuGet CLI but does support most features up until version 4.8. Version 4.9 introduces lockfiles, which are unsupported. -For package managers such as `pipenv` and `poetry`, you need to use the pip YAML value.For example, if you use `poetry` to manage your Python dependencies and want {% data variables.product.prodname_dependabot %} to monitor your dependency manifest file for new versions, use `package-ecosystem: "pip"` in your *dependabot.yml* file. +For package managers such as `pipenv` and `poetry`, you need to use the `pip` YAML value. For example, if you use `poetry` to manage your Python dependencies and want {% data variables.product.prodname_dependabot %} to monitor your dependency manifest file for new versions, use `package-ecosystem: "pip"` in your *dependabot.yml* file. From ba1ee114fac17a5994f7b88b0024ad2033e29c7a Mon Sep 17 00:00:00 2001 From: mchammer01 <42146119+mchammer01@users.noreply.github.com> Date: Thu, 28 Jan 2021 08:59:40 +0000 Subject: [PATCH 04/10] remove sentence --- data/reusables/dependabot/supported-package-managers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index ecc378d05f..95db1edf5b 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -31,6 +31,6 @@ yarn | `nmp` | v1 | | | (B) {% data variables.product.prodname_dependabot %} doesn't run Maven but supports updates to `pom.xml` files. -(C) {% data variables.product.prodname_dependabot %} doesn't run the NuGet CLI but does support most features up until version 4.8. Version 4.9 introduces lockfiles, which are unsupported. +(C) {% data variables.product.prodname_dependabot %} doesn't run the NuGet CLI but does support most features up until version 4.8. For package managers such as `pipenv` and `poetry`, you need to use the `pip` YAML value. For example, if you use `poetry` to manage your Python dependencies and want {% data variables.product.prodname_dependabot %} to monitor your dependency manifest file for new versions, use `package-ecosystem: "pip"` in your *dependabot.yml* file. From a3fb67554f4db59c9e4636298f830a26d3083724 Mon Sep 17 00:00:00 2001 From: mchammer01 <42146119+mchammer01@users.noreply.github.com> Date: Thu, 28 Jan 2021 09:12:11 +0000 Subject: [PATCH 05/10] include Maya's input --- data/reusables/dependabot/supported-package-managers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 95db1edf5b..060c26b4f9 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -10,8 +10,8 @@ Bundler | `bundler` | v1 | | **✓** | Cargo | `cargo` | v1 | **✓** | | Composer | `composer` | v1,v2 | **✓** | | Docker | `docker` | v1 | **✓** | | -Elixir | `hex` | TBD | | | Elm | `elm` | v0.18, v0.19 | **✓** | | +Hex | `hex` | TBD | | | git submodule | `gitsubmodule` | N/A (no version) | **✓** | | GitHub Actions | `github-actions` | N/A (no version) | **✓** | | Go modules | `gomod` | v1 | **✓** | **✓** | @@ -22,7 +22,7 @@ npm | `npm` | v6 | **✓** | | NuGet | `nuget` | <= 4.8.
See (C) below | **✓** | | pip | `pip` | v20 | | | pipenv | `pip` | <= 2018.11.26 | | | -pip-compile | `pip` | TBD | | | +pip-compile | `pip` | 5.5.0 | | | poetry | `pip` | TBD | | | Terraform | `terraform` | <= 0.11 | **✓** | | yarn | `nmp` | v1 | | | From 336a573c06de69ee678c40995ba1a4f1eb4e1ee7 Mon Sep 17 00:00:00 2001 From: mchammer01 <42146119+mchammer01@users.noreply.github.com> Date: Thu, 28 Jan 2021 09:15:09 +0000 Subject: [PATCH 06/10] fix order in table --- data/reusables/dependabot/supported-package-managers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 060c26b4f9..31465ba7d4 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -11,11 +11,11 @@ Cargo | `cargo` | v1 | **✓** | | Composer | `composer` | v1,v2 | **✓** | | Docker | `docker` | v1 | **✓** | | Elm | `elm` | v0.18, v0.19 | **✓** | | -Hex | `hex` | TBD | | | git submodule | `gitsubmodule` | N/A (no version) | **✓** | | GitHub Actions | `github-actions` | N/A (no version) | **✓** | | Go modules | `gomod` | v1 | **✓** | **✓** | Gradle | `gradle` | see (A) below | **✓** | | +Hex | `hex` | TBD | | | Maven | `maven` | see (B) below | **✓** | | Mix | `mix` | v1 | **✓** | | npm | `npm` | v6 | **✓** | | From 6ecd6ce3c2f615307bd21e40bb48de0ad5a96f6a Mon Sep 17 00:00:00 2001 From: mc <42146119+mchammer01@users.noreply.github.com> Date: Thu, 28 Jan 2021 11:11:55 +0000 Subject: [PATCH 07/10] Apply suggestions from code review Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> --- .../dependabot/supported-package-managers.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 31465ba7d4..d538e760bb 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -1,11 +1,11 @@ The following table shows, for each package manager: - The YAML value to use in the *dependabot.yml* file -- The supported versions +- The supported versions of the package manager - Whether dependencies in private {% data variables.product.prodname_dotcom %} repositories are supported -- Whether vendoring is supported for the package +- Whether vendored dependencies are supported -Package manager | YAML value | Supported versions | Private {% data variables.product.prodname_dotcom %} repositories | Vendoring ---- | :---:| :---:|:---:|:---: +Package manager | YAML value | Supported versions | Private repositories | Vendoring +--- | --- | --- |:---:|:---: Bundler | `bundler` | v1 | | **✓** | Cargo | `cargo` | v1 | **✓** | | Composer | `composer` | v1,v2 | **✓** | | @@ -19,13 +19,13 @@ Hex | `hex` | TBD | | | Maven | `maven` | see (B) below | **✓** | | Mix | `mix` | v1 | **✓** | | npm | `npm` | v6 | **✓** | | -NuGet | `nuget` | <= 4.8.
See (C) below | **✓** | | +NuGet | `nuget` | <= 4.8.
see (C) below | **✓** | | pip | `pip` | v20 | | | pipenv | `pip` | <= 2018.11.26 | | | pip-compile | `pip` | 5.5.0 | | | poetry | `pip` | TBD | | | Terraform | `terraform` | <= 0.11 | **✓** | | -yarn | `nmp` | v1 | | | +yarn | `npm` | v1 | | | (A) {% data variables.product.prodname_dependabot %} doesn't run Gradle but supports updates to the following files: `build.gradle` and `build.gradle.kts` (for Kotlin projects). From d67eb6168ab3b0d136e79cb3f69b36c0c82a7180 Mon Sep 17 00:00:00 2001 From: mchammer01 <42146119+mchammer01@users.noreply.github.com> Date: Fri, 29 Jan 2021 07:31:39 +0000 Subject: [PATCH 08/10] update package manager list as per feedback --- data/reusables/dependabot/supported-package-managers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index d538e760bb..bf9fea3fe4 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -10,6 +10,7 @@ Bundler | `bundler` | v1 | | **✓** | Cargo | `cargo` | v1 | **✓** | | Composer | `composer` | v1,v2 | **✓** | | Docker | `docker` | v1 | **✓** | | +Elixir | | `mix` | v1 | **✓** | | Elm | `elm` | v0.18, v0.19 | **✓** | | git submodule | `gitsubmodule` | N/A (no version) | **✓** | | GitHub Actions | `github-actions` | N/A (no version) | **✓** | | @@ -17,13 +18,12 @@ Go modules | `gomod` | v1 | **✓** | **✓** | Gradle | `gradle` | see (A) below | **✓** | | Hex | `hex` | TBD | | | Maven | `maven` | see (B) below | **✓** | | -Mix | `mix` | v1 | **✓** | | npm | `npm` | v6 | **✓** | | NuGet | `nuget` | <= 4.8.
see (C) below | **✓** | | pip | `pip` | v20 | | | pipenv | `pip` | <= 2018.11.26 | | | pip-compile | `pip` | 5.5.0 | | | -poetry | `pip` | TBD | | | +poetry | `pip` | v1 | | | Terraform | `terraform` | <= 0.11 | **✓** | | yarn | `npm` | v1 | | | From 67287967cc89f9eee93f0e8fb93d8bb58a3603ab Mon Sep 17 00:00:00 2001 From: mchammer01 <42146119+mchammer01@users.noreply.github.com> Date: Fri, 29 Jan 2021 07:41:46 +0000 Subject: [PATCH 09/10] fix table formatting --- data/reusables/dependabot/supported-package-managers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index bf9fea3fe4..9a2e3ce92a 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -10,7 +10,7 @@ Bundler | `bundler` | v1 | | **✓** | Cargo | `cargo` | v1 | **✓** | | Composer | `composer` | v1,v2 | **✓** | | Docker | `docker` | v1 | **✓** | | -Elixir | | `mix` | v1 | **✓** | | +Elixir | `mix` | v1 | **✓** | | Elm | `elm` | v0.18, v0.19 | **✓** | | git submodule | `gitsubmodule` | N/A (no version) | **✓** | | GitHub Actions | `github-actions` | N/A (no version) | **✓** | | From 64a3dfbad27a3bc5da2f120bb0678b4b356363e3 Mon Sep 17 00:00:00 2001 From: mc <42146119+mchammer01@users.noreply.github.com> Date: Fri, 29 Jan 2021 09:24:56 +0000 Subject: [PATCH 10/10] Update data/reusables/dependabot/supported-package-managers.md Co-authored-by: Philip Harrison --- data/reusables/dependabot/supported-package-managers.md | 1 - 1 file changed, 1 deletion(-) diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 9a2e3ce92a..938ac1342f 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -16,7 +16,6 @@ git submodule | `gitsubmodule` | N/A (no version) | **✓** | | GitHub Actions | `github-actions` | N/A (no version) | **✓** | | Go modules | `gomod` | v1 | **✓** | **✓** | Gradle | `gradle` | see (A) below | **✓** | | -Hex | `hex` | TBD | | | Maven | `maven` | see (B) below | **✓** | | npm | `npm` | v6 | **✓** | | NuGet | `nuget` | <= 4.8.
see (C) below | **✓** | |