Dependabot doesn't pin to major version anymore with GitHub Actions

[crazy-max]

Hi,

This morning I have a ton of PRs created by Dependabot although I have pinned to the major version and it does match the latest semver available so I think there's been a recent change in the last few hours that breaks this.

Here is a list of some repos:

• https://github.com/crazy-max/diun/pulls
• https://github.com/crazy-max/goreleaser-xx/pulls

Thanks!

[akien-mga]

Confirmed, see e.g. godotengine/godot-docs#4908.

[aaronfranke]

Some more examples of undesired/unexpected/incorrect version bumping:
godotengine/tps-demo#102
aaronfranke/godot-measuring-tape#1

[ocean90]

Maybe related to some changes in #3662? This was released two days ago though.

[korelstar]

A workaround would be to set version_requirement_updates=widen_ranges, but according to the documentation, this is not available for GitHub Actions.

[crazy-max]

@thepwagner Thanks for the fix! Any ETA? Just want to be sure before closing the PRs thanks!

[thepwagner]

@crazy-max in QA now, should be live within a few hours (I'll ping here)

[ocean90]

Thanks for the quick fix! Once it’s live, will Dependabot close all the PRs automatically on the next check or do we have to close them manually?

[thepwagner]

Sorry for the noise: the fix has been deployed to the GitHub version of Dependabot as 0.146.1-6728db7e2024e6b0ab5ec73b41f9a69b5c30fbf4 (since 2021-05-12 20:27:17 +0000)

will Dependabot close all the PRs automatically on the next check or do we have to close them manually

They won't be closed by the next check for any available updates: Dependabot will see no update available and move on.

They will be closed if a rebase of a particular PR is requested, like: #3706 (comment) , in that case Dependabot sees the expected update is no longer possible and closes the PR.
One workaround: if you push any change to .github/workflows/*.yaml, Dependabot will automatically rebase all open Actions PRs. That will trigger the "dependency is up to date now" case in each PR, and should auto-close. Unfortunately it's limited to a single repository.

[bewuethr]

Added to a discussion at community/community#12303