Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Mass update when a Ruby gem is yanked #2153

Closed
connorshea opened this issue May 21, 2019 · 2 comments
Closed

Mass update when a Ruby gem is yanked #2153

connorshea opened this issue May 21, 2019 · 2 comments
Labels
F: dependency-downgrades Avoiding unintentional downgrades, or forcing downgrades when really needed F: language-support Issues specific to a particular language or ecosystem; may be paired with an L: label. L: ruby:bundler RubyGems via bundler Stale T: feature-request Requests for new features

Comments

@connorshea
Copy link

A few days ago dependabot updated ffi in my repo to 1.11.0. Yesterday, 1.11.0 was yanked. I only noticed this after trying to run a bundle install locally, which failed.

Should Dependabot run an 'emergency' update across all repositories when a gem is yanked like this, in the same way it does for major security updates?

See also dependabot/feedback#471.
@connorshea
Copy link
Author

In this case, 1.11.0 was yanked and 1.11.1 was released, I’m not sure if it’d be a common occurrence that a version is yanked but no new version is immediately released, but maybe worth considering a downgrade strategy?

I imagine dependabot isn’t really built with downgrading in mind, though, so probably not worth the trouble :)

@infin8x infin8x transferred this issue from dependabot/feedback Jun 29, 2020
@infin8x infin8x added F: language-support Issues specific to a particular language or ecosystem; may be paired with an L: label. L: ruby:bundler RubyGems via bundler T: feature-request Requests for new features labels Jul 2, 2020
@iBotPeaches iBotPeaches mentioned this issue Nov 6, 2021
Open
@deivid-rodriguez deivid-rodriguez added the F: dependency-downgrades Avoiding unintentional downgrades, or forcing downgrades when really needed label Aug 31, 2022
@dependabot dependabot deleted a comment from stale bot Nov 24, 2022
@deivid-rodriguez deivid-rodriguez mentioned this issue Dec 6, 2022
Open
1 task
@github-actions GitHub Actions
Copy link
Contributor

👋 This issue has been marked as stale because it has been open for 2 years with no activity. You can comment on the issue to hold stalebot off for a while, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details.

@github-actions github-actions bot added the Stale label Nov 24, 2024
@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Dec 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
F: dependency-downgrades Avoiding unintentional downgrades, or forcing downgrades when really needed F: language-support Issues specific to a particular language or ecosystem; may be paired with an L: label. L: ruby:bundler RubyGems via bundler Stale T: feature-request Requests for new features
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@infin8x @deivid-rodriguez @connorshea