[Python] Dependabot changes ~=1.1.0 to >=1.1.0,<1.3.0

[daviddavis]

We have our requirements specified in Python using ~= and instead of just bumping the version, dependabot insists on changing the format using >=,<.

[rebelagentm]

Hi! 👋 Thanks for reporting this. The team is pretty swamped at the moment scaling Dependabot for all of GitHub , but we'll take a look at this as soon as we can.

[PerchunPak]

Can't reproduce in last time (fire-square/fire-square-style#49, PerchunPak/pinger-bot#49, fire-square/fire-square-style#45).
Last PR with this problem was PerchunPak/mcph#43.

Is this was accidentally fixed?

[PerchunPak]

Reproduced this again in PerchunPak/mcph#47, maybe it's now happening when dependency's version bumps on 2 version in one time?

[deivid-rodriguez]

Hello @PerchunPak! Sorry for not getting back earlier, too many things you know 😅.

I actually think this is intentional. Dependabot default for libraries (as opposed to applications, which would get the behavior you want by default) is to widen requirements instead of bumping them, see https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#versioning-strategy.

You should get what you want by changing your configuration once we support the increase and increase-if-necessary strategies in Python. This is not yet supported, but will be very soon.

[PerchunPak]

Hello @PerchunPak! Sorry for not getting back earlier, too many things you know 😅.

I actually think this is intentional. Dependabot default for libraries (as opposed to applications, which would get the behavior you want by default) is to widen requirements instead of bumping them, see https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#versioning-strategy.

You should get what you want by changing your configuration once we support the increase and increase-if-necessary strategies in Python. This is not yet supported, but will be very soon.

👍 Is there any PR/tracking issue for this feature?

[deivid-rodriguez]

We added the required changes in this repo at #5605, but then I noticed that we still need some internal changes for this to work. I will update and close this issue once we roll those out.

[deivid-rodriguez]

@PerchunPak This is now live, can you verify the increase-if-necessary strategy works for you?

[deivid-rodriguez]

I'm going to close since I verified the new version strategy is properly picked up, but feel free to reopen if you are still having issues after changing the versioning strategy to increase-if-necessary, thanks!