dependabot / dependabot/dependabot-core

Dependabot cannot update package because of git_dependency_reference_not_found

Open
#11,022 0 comments 0 reactions 0 assignees View on GitHub
L: python T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

Pip

### Package manager version

_No response_

### Language version

python_version = "3.11"

### Manifest location and content before the Dependabot update

./src/Pipfile

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[packages]
flask = "==3.0.3"
marshmallow = "==3.19.0"
dependency-injector = "==4.42.0"
mypckg = {ref = "mypckg-v1.0.0", git = "git+https://${MY_GH_PAT}@github.com/org/python-packages.git", subdirectory = "src/mypckg"}

[requires]
python_version = "3.11"

### dependabot.yml content

version: 2
registries:
python-packages:
type: git
url: https://github.com
username: x-access-token
password: ${{secrets.MY_GH_PAT}}
updates:
- package-ecosystem: "pip"
directory: "/src"
schedule:
interval: "daily"
open-pull-requests-limit: 0
registries: "*"
insecure-external-code-execution: allow

### Updated dependency

werkzeug

### What you expected to see, versus what you actually saw

I want to see that the dependabot creates a PR with a new version of werkzeug, but instead of dependabot pipelines are failed with this error:
Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+-------------------------------------------+
| Dependencies failed to update |
+----------+--------------------------------+
| werkzeug | git_dependencies_not_reachable |
+----------+--------------------------------+

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the werkzeug update with src/Pipfile and dependabot.yml, paying particular attention to the mypckg git dependency and its ref. Then inspect the Pip ecosystem handling of git dependencies and compare the reported git_dependency_reference_not_found and git_dependencies_not_reachable errors. Done means Dependabot can create the werkzeug update PR without the unrelated git dependency blocking the run.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, python
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.