Improve what version should be picked

[JavierSegoviaCordoba]

Currently, I am seeing multiple issues:

- val coroutines = "1.4.3"
+ val coroutines = "1.4.3-native-mt"

val dokka = "1.4.20"
val dokka = "1.4.20-dev-65"

The first one really is mixing a version from "different libs" caused by how coroutines library is releasing the artifact.

The second one is using a dev version that can't be even used in the project because it hasn't the necessary repository.

I can understand that here we can have a real problem about how to solve this issue in a generic way because some libs can use semantic versioning, but, as a workaround, why just don't let the user specify a regex?

It allows filtering unnecessary versions and it can be modified to allow a custom approach for those versions that don't follow semantic versioning.

version: 2
updates:
  - package-ecosystem: "gradle"
    directory: "/"
	version-regex: "..."
    schedule:
      interval: "daily"

[feelepxyz]

@JavierSegoviaCordoba we have a bunch of logic around this already so might not be too hard to add support for these prefixes. Do you have a sample project/manifest file to share that reproduces the issue?

[JavierSegoviaCordoba]

I checked that the dev version was published to the wrong repository instead of the snapshot one so there is no fail from dependabot there, for the coroutines one, it is a pattern that coroutines libraries does.

Anyway, there is no way we can't filter them, why adding the possibility to use a custom regex is blocked? I think there is no way to solve this problem in a generic way without adding a custom regex.

[jurre]

I think this should be resolved now, feel free to reopen if still running into things

[Glennmen]

@jurre I don't think it was resolved, we received this PR 2 weeks ago wisemen-digital/AndroidCore#38

Or do we need to add some kind of ignore filter for this?

[JavierSegoviaCordoba]

@jurre IMO until a regex function to filter is added, there is no way to resolve the underlying problem I mentioned here.

Literally, there are infinite edge cases that dependabot can't handle because any developer can use whatever versioning he wants, so I can't understand why that regex doesn't exist.

[Glennmen]

Also I found this issue where Google also made a special case for this in Android Studio (or the Gradle plugin not sure) https://issuetracker.google.com/issues/171369798#comment9

Maybe Dependabot could add something like this?

[ashughes]

FYI, this has also been reported/discussed in #2547 and #2460.