Support "*" parameter in folder paths

[petergrau]

We have several plugins in one repo that all have their own package.json. We would like to define one directory path that catches all of them - something like:
/libs/*/
That should include then all package.json of the libs without having to define an entry for each of them following all the same ruleset.

[feelepxyz]

@petergrau have you looked at using yarn workspaces or lerna to specify a glob for all your sub-projects? This way dependabot will find all the nested package.json files if you add the root one that contains the workspace config/lerna config file.

For example using yarn workspaces:

package.json

{
  "private": true,
  "workspaces": ["libs/*"]
}

[petergrau]

@petergrau have you looked at using yarn workspaces or lerna to specify a glob for all your sub-projects? This way dependabot will find all the nested package.json files if you add the root one that contains the workspace config/lerna config file.

For example using yarn workspaces:

package.json

{
  "private": true,
  "workspaces": ["libs/*"]
}

@feelepxyz something like that would work for us but we are using nx with the nx.json - is that supported as well?

[feelepxyz]

@petergrau ah unfortunately not. Will keep an eye out for more demand as it's the first time I've come across that.

[maneetgoyal]

Will be great to have.

Using lerna with yarn workspaces. Here's my dependabot.yml:

version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: daily
    open-pull-requests-limit: 10

When dependabot creates a PR for updating the dependencies that are present in only the child packages like root/packages/**/abc, root/packages/**/def, etc., it only updates the yarn.lock. Would be great if it updates the package.json of the child packages as well (not just the root level package.json).

[Abildtoft]

We have a similar use case (with NX)

Thanks for an awesome tool!

[alexf101]

In case it's helpful, I suggested some awful hacks to work around this for now here: #2178 (comment)

[feelepxyz]

Closing as a duplicate of #2178

This isn't specific to the package manager and requires some deeper changes in the way dependabot fetches the repo contents to work. We've got some ideas around how this will also play into grouped updates.

We don't have any current plans on supporting nx unfortunately.