dependabot / dependabot/dependabot-core

Python multi-dir update results in duplicate PRs

Open
#10,340 1 comment 3 reactions 0 assignees View on GitHub
L: git:submodules L: python T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

Python - pip and pip-compile

### What you expected to see, versus what you actually saw

Reproducible with the following input file:

```yml
job:
allowed-updates:
- dependency-type: direct
update-type: all
package-manager: pip
source:
provider: github
repo: opentracing-contrib/nginx-opentracing
commit: 69dd153598307375363650ea301c92cb59d997f3
api-endpoint: https://api.github.com/
hostname: github.com
directories:
- "/**/*"
```

Run with the Dependabot CLI: `dependabot update -f input.yml`

The issue seems to be caused by the FileFetcher's behavior in the Python ecosystem of searching subdirectories for requirements files:

https://github.com/dependabot/dependabot-core/blob/4420d677450d0e685c6b2f49aed16a3b14aec788/python/lib/dependabot/python/file_fetcher.rb#L243-L257

This results in the same requirements file appearing twice, thus it puts up 2 PRs.

We'll need to analyze why this behavior exists and maybe remove it. Ideally Dependabot would only process the directory it was given.

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the provided input.yml using `dependabot update -f input.yml`. Start in python/lib/dependabot/python/file_fetcher.rb at lines 243-257 and inspect why subdirectory searching returns the same requirements file twice. Done means the repository configuration produces one PR rather than duplicate PRs.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.