Q: how to edit bot commits?

[php-coder]

I'd like to include links to the changelogs in commit messages. How I can do that? (And these links not the same as bot includes in PR.)

[greysteil]

Dependabot should already be including those, if it can find them. The relevant code is here.

Is there an example PR it should have got a changelog for?

[php-coder]

Is there an example PR it should have got a changelog for?

There are plenty of them:

• Bump togglz.version from 2.5.0.Final to 2.6.1.Final php-coder/mystamps#946
• Bump maven-failsafe-plugin from 2.19.1 to 2.22.0 php-coder/mystamps#936 (this plugin lives together with surefire plugin -- https://github.com/apache/maven-surefire)
• Bump liquibase.version from 3.5.5 to 3.6.2 php-coder/mystamps#942
• Bump commons-lang3 from 3.4 to 3.7 php-coder/mystamps#943
• [Security] Bump groovy-all from 2.0.8 to 2.4.15 php-coder/mystamps#938

[greysteil]

Ah, Maven, yeah, we're not as good at finding the repo for those because there's not much info embedded in the registry 😞.

The lookup logic we use is here - I'll see if I can improve it.

[greysteil]

OK, I reckon I've got a way for Dependabot to find links to the repos for togglz, maven-failsafe-plugin and liquibase. commons-lang3 is harder, because the GitHub repo for it is a mirror and isn't mentioned anywhere in the POM, and it looks like Dependabot did find the repo for groovy-all, it's just that there wasn't a changelog there (unless it's looking in the wrong place?).

Will get the change I'm thinking of implemented tomorrow morning.

[greysteil]

OK, I've just deployed dependabot/dependabot-core@1c40442, which should improve things here. It won't be perfect, but finding changelogs is something of a whack-a-mole issue!

If you see others that Dependabot has missed / could do better one, please do tag me in the PR (you can just mention @dependabot to do so).