dependabot / dependabot/dependabot-core
Dependabot cannot update package because of git_dependency_reference_not_found
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
Pip
### Package manager version
_No response_
### Language version
python_version = "3.11"
### Manifest location and content before the Dependabot update
./src/Pipfile
[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true
[packages]
flask = "==3.0.3"
marshmallow = "==3.19.0"
dependency-injector = "==4.42.0"
mypckg = {ref = "mypckg-v1.0.0", git = "git+https://${MY_GH_PAT}@github.com/org/python-packages.git", subdirectory = "src/mypckg"}
[requires]
python_version = "3.11"
### dependabot.yml content
version: 2
registries:
python-packages:
type: git
url: https://github.com
username: x-access-token
password: ${{secrets.MY_GH_PAT}}
updates:
- package-ecosystem: "pip"
directory: "/src"
schedule:
interval: "daily"
open-pull-requests-limit: 0
registries: "*"
insecure-external-code-execution: allow
### Updated dependency
werkzeug
### What you expected to see, versus what you actually saw
I want to see that the dependabot creates a PR with a new version of werkzeug, but instead of dependabot pipelines are failed with this error:
Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+-------------------------------------------+
| Dependencies failed to update |
+----------+--------------------------------+
| werkzeug | git_dependencies_not_reachable |
+----------+--------------------------------+
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start by reproducing the werkzeug update with src/Pipfile and dependabot.yml, paying particular attention to the mypckg git dependency and its ref. Then inspect the Pip ecosystem handling of git dependencies and compare the reported git_dependency_reference_not_found and git_dependencies_not_reachable errors. Done means Dependabot can create the werkzeug update PR without the unrelated git dependency blocking the run.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, python
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100