Dependabot-core: dependabot should prefer 'scm > url' instead of just the 'url' otherwise uses wrong repo (link) in MR

[TheSnoozer]

Hello,
thanks for dependabot. I noticed a small discrepancy in an automatic security fix for jackson-databind (CVE-2019-16942). Essentially it seems that dependabot assumes that https://github.com/FasterXML/jackson is the repo to search for changes, however in this case https://github.com/FasterXML/jackson-databind/ is the right one.

Notice the link that is being used for "jackson-databind" in https://github.com/git-commit-id/maven-git-commit-id-plugin/pull/451. Furthermore the "see full diff" link also links to the "wrong" repo.

Public URL:
https://github.com/git-commit-id/maven-git-commit-id-plugin/pull/451

[feelepxyz]

@TheSnoozer oh looks like this is coming from the published maven package so would have to be updated there. Would you wanna open an issue on their repo to update? 🙏 Will close this out as we can't fix this on our side.

[TheSnoozer]

Hi,
thanks for the feedback and response!

Just to clarify:
To fix this issue the URL in the pom (https://github.com/FasterXML/jackson-databind/blob/ed7d0a83b9bc9df1d95eb58a853760d780e7c450/pom.xml#L17) needs to be updated correct? (just want to rule out that dependabot uses some other URL...)

[feelepxyz]

@TheSnoozer oh actually, we probably want to use the scm > url if this exists which looks correct: https://github.com/FasterXML/jackson-databind/blob/ed7d0a83b9bc9df1d95eb58a853760d780e7c450/pom.xml#L23

Not seen this before so we're probably not aware of this field atm. Will look at updating this in Dependabot 👌

[feelepxyz]

@rebelagentm you up for looking at this? Think it should be pretty straight forward to change the place where we get the dependency repository for Maven packages to get the above scm > url if this is present.

[TheSnoozer]

Hi thanks for your input :-)
Could you perhaps reopen this issue (I don't have permissions)?

I also rephrased the title of the issue, since it's now clearer what goes wrong here.

[rebelagentm]

@feelepxyz I can do that!

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs within seven days. Thank you for your contributions.

[TheSnoozer]

• comment to remove stale label :-)