Lerna packages glob pattern seems inaccurate

[imhoffd]

Thanks for Lerna support! ❤️

Everything is working great, but I think globbing may be slightly inaccurate.

We use the following config for our lerna packages:

  "packages": [
    "packages/**"
  ],

We have packages within the packages/ folder, but also within subfolders. It is common to have scoped packages in another level, such as packages/my-package and packages/@my-scope/my-package.

lerna ls shows packages correctly according to our glob (packages/**), but the dependabot UI does not when I hover over the ellipsis next to the package.json for the Lerna repository (only the the packages directly in packages/ folder). Additionally, PRs aren't opened for the packages deeper within packages/, so we aren't getting PRs for our scoped packages.

More specifics here: #197 (comment)

[greysteil]

Thanks for this @dwieeb. I'll take a look into it today.

[greysteil]

Just shipped a fix for this and looks like it's working. Dependabot won't fetch deeply nested packages, but it will now consider one level of nesting, which should be enough for pretty much all use cases.

(Since Dependabot doesn't clone your repo going to full nesting could generate a lot of GitHub requests.)

Thanks for the heads up!