Dependabot dependency scope yarn support

[David-Hart-i2]

Hi,

It is great to see the ability to filter dependency alerts on scope (development vs runtime). I notice from the changelog documentation that npm is supported but yarn is not.

https://github.blog/changelog/2022-06-23-dependabot-alerts-filter-alerts-by-the-scope-of-the-dependency-runtime-and-development/

Is this just because the ecosystem parser only reads package-lock.json files, and not yarn.lock files?

I don't see anything on the public roadmap for enhancing this behavior to include the yarn ecosystem, is it work that is planned?

Many thanks

[SalimBensiali]

I would love to see support for this too. I currently work around this limitation with an auto-labelling workflow leveraging the https://github.com/dependabot/fetch-metadata action for direct dependencies and npm ls --{prod,dev} <package-name> for the indirect ones. See https://github.com/SalimBensiali/le-blanc-jewellery/blob/master/.github/workflows/dependabot-auto-label.yml#L49-L53.

There are two limitations with this approach though:

1. This will be labelling the associated PRs instead of the alerts themselves.
2. This will only work for alerts for which Dependabot successfully manages to raise a security update PR.

It seems running npm ls --{prod,dev} <package-name> works for both npm and yarn so I am surprised the runtime vs development scope feature on dependabot alerts is only supported for npm.

[jge162]

@David-Hart-i2 thanks for you post, npm uses package-lock.json files, which provides more information about the dependencies and their versions, whereas yarn uses yarn.lock files do not provide this information in the same format.

I don't see anything on the public roadmap for enhancing this behavior to include the yarn ecosystem, is it work that is planned?

No answer for you on roadmap. Keep checking maybe.

[SalimBensiali]

Has this now been fixed? I started seeing the development label on a bunch of Dependabot alerts. These used to previously all be labelled as runtime scoped.

I could not find any official announcement for this though.