dependabot / dependabot/dependabot-core

Dependabot reports an out of date dependency in a file that hasn't existed for years

Open
#10,751 4 comments 1 reaction 0 assignees View on GitHub
L: python T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 14h
Merged PRs (30d)
156

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

pip

### Package manager version

24.2

### Language version

All current python versions

### Manifest location and content before the Dependabot update

The bug is that dependabot is looking at a requirements.txt file that hasn't existed in the code base for many years. It reports out of date dependencies in `scripts/tile_benchmark/requirements.txt`, a file that was deleted from the repo in 2018.

### dependabot.yml content

https://github.com/girder/large_image/blob/master/.github/dependabot.yml

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Dependabot reports an out of date Pillow package in a requirements.txt file that hasn't been in the repo since 2018. It can't update this file because it doesn't exist. The file does not exit in any extant branch. Dependabot can't make PRs because the file doesn't exist. I expect to NOT get updates for files that don't exist.

Specifically, I get security warnings like:
```
Dependabot is creating a security update to fix [6 Dependabot alerts](https://github.com/girder/large_image/security/dependabot?q=is%3Aopen+package%3Apillow+manifest%3Ascripts%2Ftile_benchmark%2Frequirements.txt+has%3Apatch) on pillow in [scripts/tile_benchmark/requirements.txt](https://github.com/girder/large_image/blob/-/scripts/tile_benchmark/requirements.txt).

Or, manually upgrade pillow to version 8.1.1 or later. For example:

pillow>=8.1.1
```

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.