Spock's versioning confuses Dependabot

[britter]

Describe the bug

Due to the versioning scheme of Spock 2.x having the Groovy compatibility encoded in the version, Dependabot will always send updates to the groovy-4 variant.

To Reproduce

1. Create a Gradle project with a dependency to org.spockframework:spock-core:2.1-groovy-3.0
2. Enable Dependabot and chose gradle as the package-ecosystem
3. Wait
4. You will get a PR that tries to update to org.spockframework:spock-core:2.3-groovy-4.0 (or whatever the latest 2.x release is at that time)

Expected behavior

Spockframework should use the classifier portion of the GAV to indicate Groovy compatibility. That way Dependabot can distinguish between the two Groovy variants.

Actual behavior

Spockframework appends the variant information to the version number, which isn't recognized by Dependabot.

Java version

N/A

Buildtool version

N/A

What operating system are you using

Mac

Dependencies

org.spockframework:spock-core:2.1-groovy-3.0

Additional context

No response

[Vampire]

Dependabot is just one of the many fields this makes problems.
It is for example practically impossible for a Spock plugin to properly depend on Spock due to this.

I also always disliked this encoding in the version.
But encoding the groovy compatibility in the classifier would be even worse, then you do not get the dependencies or always have to have two dependencies.

I still think the proper solution would be to leverage feature variants for this.

[szpak]

I had similar issue with Renovate and there it was possible to add some extra rules as a workaround:

packageRules: [
    ...
    {
      matchPackagePrefixes: ["org.spockframework:spock-"],
      matchCurrentVersion: "/-groovy-3\\.0$/",
      allowedVersions: "/-groovy-3\\.0$/"
    },
    {
      matchPackagePrefixes: ["org.spockframework:spock-"],
      matchCurrentVersion: "/-groovy-4\\.0$/",
      allowedVersions: "/-groovy-4\\.0$/"
    },
]

Maybe something similar is also possible with Dependabot?

[bgalek]

Got the same problem today, nothing else comes in mind but ignoring Spock in dependabot ;(