dependabot / dependabot/dependabot-core
Dependabot reports an out of date dependency in a file that hasn't existed for years
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 156
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
pip
### Package manager version
24.2
### Language version
All current python versions
### Manifest location and content before the Dependabot update
The bug is that dependabot is looking at a requirements.txt file that hasn't existed in the code base for many years. It reports out of date dependencies in `scripts/tile_benchmark/requirements.txt`, a file that was deleted from the repo in 2018.
### dependabot.yml content
https://github.com/girder/large_image/blob/master/.github/dependabot.yml
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
Dependabot reports an out of date Pillow package in a requirements.txt file that hasn't been in the repo since 2018. It can't update this file because it doesn't exist. The file does not exit in any extant branch. Dependabot can't make PRs because the file doesn't exist. I expect to NOT get updates for files that don't exist.
Specifically, I get security warnings like:
```
Dependabot is creating a security update to fix [6 Dependabot alerts](https://github.com/girder/large_image/security/dependabot?q=is%3Aopen+package%3Apillow+manifest%3Ascripts%2Ftile_benchmark%2Frequirements.txt+has%3Apatch) on pillow in [scripts/tile_benchmark/requirements.txt](https://github.com/girder/large_image/blob/-/scripts/tile_benchmark/requirements.txt).
Or, manually upgrade pillow to version 8.1.1 or later. For example:
pillow>=8.1.1
```
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.