You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The following details describe how {% data variables.product.prodname_dependabot %} interprets versioning for specific ecosystems.
31
54
32
-
***Bundler:** Bundler does not use a fixed set of prerelease tags. Any version segment containing a letter is treated as a prerelease (for example, `.alpha`, `.beta1`, `.rc2`). Hyphens in version strings are normalized to `.pre.` internally (for example, `1.0.0-beta` becomes `1.0.0.pre.beta`).
33
-
***Cargo:** Follows SemVer 2.0.0 prerelease conventions. Anything after `-` is a prerelease identifier (dot-separated, `[0-9A-Za-z-]`). Build metadata (`+...`) is allowed but ignored for version precedence.
34
-
***Gradle:** Aliases are also recognized: `pr`/`pre`/`preview`→`rc`, `eap`/`ea`→`alpha`. Additional prerelease qualifiers include `dev`, `experimental`, and `unstable`. Qualifiers are ordered by precedence: `alpha`/`a` < `beta`/`b` < `milestone`/`m` < `rc`/`cr` < `snapshot` < (empty/`ga`/`final`/`release`) < `sp`. Free-form identifiers not in this list are treated as stable.
35
-
***pip/pipenv/pip-compile/poetry (PEP 440):** The table lists canonical prerelease and postrelease suffixes per PEP 440. Aliases are also recognized and normalized to their canonical forms (`alpha`→`a`, `beta`→`b`, `c`/`pre`/`preview`→`rc`, `rev`/`r`→`post`). Epoch versions (`N!...`) and local versions (`+local`) are supported; local version segments are used only to break ties when the public version is identical.
36
-
***Elm:** The Elm package registry enforces strict SemVer (`MAJOR.MINOR.PATCH` integers only) and does not allow publishing pre-release versions. Dependabot compares versions numerically.
37
-
***Go modules:** Follows SemVer with a mandatory `v` prefix. Pseudo-versions (`v0.0.0-YYYYMMDDHHMMSS-commithash`) are used for unreleased commits and are always treated as pre-release. The `+incompatible` suffix marks modules at major version 2+ without a `go.mod` file and does not affect version ordering.
38
-
***git submodule:** Dependabot tracks the latest commit on the configured branch. There is no version comparison—updates always move the pinned SHA forward. If the submodule tracks a tag, Dependabot follows the tag's commit.
55
+
***Bundler:** Does not use a fixed set of prerelease tags. Any version segment containing a letter is treated as prerelease (for example, `.alpha`, `.beta1`, `.rc2`). Hyphens are normalized to `.pre.` internally (for example, `1.0.0-beta` becomes `1.0.0.pre.beta`).
56
+
***Cargo:** Follows SemVer 2.0.0 conventions. Anything after `-` is a prerelease identifier (dot-separated, `[0-9A-Za-z-]`). Build metadata (`+...`) is allowed but ignored for precedence.
57
+
***Gradle:** In addition to the qualifiers listed in the table, these aliases are recognized: `pr`/`pre`/`preview`→`rc`, `eap`/`ea`→`alpha`. Additional prerelease qualifiers include `dev`, `experimental`, and `unstable`. Qualifiers are ordered by precedence: `alpha`/`a` < `beta`/`b` < `milestone`/`m` < `rc`/`cr` < `snapshot` < (empty/`ga`/`final`/`release`) < `sp`. Free-form identifiers not in this list are treated as stable.
58
+
***pip/pipenv/pip-compile/poetry (PEP 440):** The table lists canonical prerelease and postrelease suffixes. Aliases are also recognized and normalized (`alpha`→`a`, `beta`→`b`, `c`/`pre`/`preview`→`rc`, `rev`/`r`→`post`). Epoch versions (`N!...`) and local versions (`+local`) are supported; local segments are used only to break ties when the public version is identical.
59
+
***Elm:** Enforces strict SemVer (`MAJOR.MINOR.PATCH` integers only). The Elm package registry does not allow publishing prerelease versions. {% data variables.product.prodname_dependabot %} compares versions numerically.
60
+
***Go modules:** Follows SemVer with a mandatory `v` prefix. Pseudo-versions (`v0.0.0-YYYYMMDDHHMMSS-commithash`) represent unreleased commits and are always treated as prerelease. The `+incompatible` suffix marks modules at major version 2+ without a `go.mod` file and does not affect version ordering.
61
+
***git submodule:** {% data variables.product.prodname_dependabot %} tracks the latest commit on the configured branch. There is no version comparison—updates always move the pinned SHA forward. If the submodule tracks a tag, {% data variables.product.prodname_dependabot %} follows the tag's commit.
62
+
{% ifversion dependabot-bazel-support %}
63
+
***Bazel:** Follows SemVer prerelease conventions. The Bazel Central Registry (BCR) `.bcr.N` suffix is stripped before comparison and does not affect prerelease detection.
64
+
{% endif %}
65
+
***Bun:** Follows npm-style SemVer prerelease conventions. Build metadata (`+...`) is supported but ignored for version precedence.
66
+
{% ifversion dependabot-deno-support %}
67
+
***Deno:** Follows SemVer prerelease conventions. Build metadata (`+...`) is supported but ignored for version precedence.
68
+
{% endif %}
69
+
***{% data variables.product.prodname_actions %}:** {% data variables.product.prodname_dependabot %} resolves action versions from git tags. Any tag with a SemVer prerelease identifier (anything after `-`) is treated as prerelease. Additionally, releases marked as prerelease via the GitHub Release API are recognized regardless of tag format.
70
+
***Hex:** Follows SemVer prerelease conventions. Any identifier after `-` is treated as prerelease.
71
+
{% ifversion dependabot-julia-support %}
72
+
***Julia:** Follows SemVer prerelease conventions. Prerelease identifiers are case-sensitive (for example, `DEV` and `dev` are distinct).
73
+
{% endif %}
74
+
{% ifversion dependabot-nix-support %}
75
+
***Nix:** {% data variables.product.prodname_dependabot %} tracks flake input commits, similar to git submodules. The table shows user-facing commit SHAs; internally, versions are represented as pseudo-versions (`0.0.0-0.N`). There is no traditional version comparison—updates move forward to the latest upstream commit.
76
+
{% endif %}
77
+
***NuGet:** Follows SemVer 2.0.0 prerelease conventions. Build metadata (`+...`) is supported but ignored for version precedence.
78
+
{% ifversion dependabot-opentofu-support %}
79
+
***OpenTofu:** Follows SemVer prerelease conventions (same as Terraform). Build metadata (including the `+backport` suffix) is stripped before comparison and does not affect prerelease detection.
80
+
{% endif %}
81
+
{% ifversion dependabot-rust-toolchain-support %}
82
+
***Rust toolchain:** Uses channel-based versioning (`stable`, `beta`, `nightly`) rather than SemVer prerelease identifiers. {% data variables.product.prodname_dependabot %} updates the pinned channel or date-stamped nightly (for example, `nightly-2024-01-15`) to the latest available.
83
+
{% endif %}
84
+
***Terraform:** Follows SemVer prerelease conventions. The `v` prefix is stripped before comparison. Build metadata (`+...`) is ignored for version precedence.
0 commit comments