dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.

Home Page:https://docs.github.com/en/code-security/dependabot

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

New commit message `---` as headline (used to be useful information)

christianhujer opened this issue · comments

Is there an existing issue for this?

  • I have searched the existing issues

Package ecosystem

Gradle

Package manager version

8.7

Language version

Java 21 / Kotlin

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
  - package-ecosystem: "gradle"
    directory: "/"
    schedule:
      interval: "daily"

Updated dependency

This appears to happen to all dependencies managed by Gradle. I saw this happening on the following examples:

  • Bump jakarta.validation:jakarta.validation-api from 3.0.2 to 3.1.0
  • Bump org.jetbrains.kotlin:kotlin-reflect from 1.9.24 to 2.0.0

The Pull Requests still had the correct title. But the commit message is no longer useful.

What you expected to see, versus what you actually saw

I expect the commit message from Dependabot to be something that in the headline mentions the dependency that's updated, the old version, and the new version. Something like this:

Bump io.cucumber:cucumber-spring from 7.17.0 to 7.18.0

What I actually saw was a commit message that omitted the Bump part of the commit message and therefore was only the following:

    ---
    updated-dependencies:
    - dependency-name: org.jetbrains.kotlin:kotlin-reflect
      dependency-type: direct:production
      update-type: version-update:semver-major
    ...

This leads to a history that shows only --- as the commit summary, which is not very helpful.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

I have not created an isolated test case yet. I will create one in a public repository, and to see whether it works, I will have to wait for Dependabot to pick it up.

Duplicate of #9784 (which I didn't see earlier)