dependabot / dependabot/dependabot-core
Including constraints refs in `requirements.in` makes dependabot skip updates
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
When using pip-tools, one of the approaches is to [add `-c requirements.txt` in `requirements.in`](https://github.com/jazzband/pip-tools#workflow-for-layered-requirements).
Also, when using this approach `pip install -r requirements.in` automatically implies `-c requirements.txt`.
Today I experimentally confirmed that dependabot fails to update dependencies in pip-compile managed files whenever they are linked with such a reference.
In one of my projects, I commented out this ref (https://github.com/ansible/pylibssh/commit/79476476d34bc44a1f76e95db1e89bc25aadf83f) and got a PR after that: https://github.com/ansible/pylibssh/pull/83.
It currently uses the "legacy" dependabot-preview GitHub App but in another repo I tried out enabling this new "native beta" and the failure is the same (see the log below).
**Package manage/ecosystem**
pip/pip-tools/pip-compile
**Manifest contents prior to update**
```ini
# requirements.in
-c requirements.txt
Cython
```
```ini
# requirements.txt
...
cython==0.29.14 \
--hash=sha256:...
...
```
**Updated dependency**
None, unfortunatelly.
**What you expected to see, versus what you actually saw**
Lock file updated.
**Images of the diff or a link to the PR, issue or logs**
```console
proxy | time="2020-07-01T13:46:16Z" level=info msg="proxy starting" commit=a56e4b1997517cac92a8e8ad56c1aa52b4c43980
proxy | 2020/07/01 13:46:16 Listening (:1080)
updater | time="2020-07-01T13:46:18Z" level=info msg="guest starting" commit=14149ee5d994baaaf2f4596e5271ad736d482620
updater | time="2020-07-01T13:46:18Z" level=info msg="starting job..." job_id=32913527 updater_version=0.118.5-1ea51cbfa775e14d6bbdf7573e3809d689e16029
updater | yarn config v1.22.4
updater | success Set "cafile" to "/etc/ssl/certs/ca-certificates.crt".
updater | Done in 0.03s.
updater | warning: parser/current is loading parser/ruby26, which recognizes
updater | warning: 2.6.6-compliant syntax, but you are running 2.6.5.
updater | warning: please see https://github.com/whitequark/parser#compatibility-with-ruby-mri.
updater | INFO Starting job processing
proxy | 2020/07/01 13:46:23 GET https://api.github.com:443/repos/ansible/ansible-lint
proxy | 2020/07/01 13:46:23 * authenticating github api request
proxy | 2020/07/01 13:46:23 200 https://api.github.com:443/repos/ansible/ansible-lint
proxy | 2020/07/01 13:46:23 GET https://api.github.com:443/repos/ansible/ansible-lint/git/refs/heads/master
proxy | 2020/07/01 13:46:23 * authenticating github api request
proxy | 2020/07/01 13:46:23 200 https://api.github.com:443/repos/ansible/ansible-lint/git/refs/heads/master
proxy | 2020/07/01 13:46:23 GET https://api.github.com:443/repos/ansible/ansible-lint/contents/docs?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:23 * authenticating github api request
proxy | 2020/07/01 13:46:23 200 https://api.github.com:443/repos/ansible/ansible-lint/contents/docs?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:23 GET https://api.github.com:443/repos/ansible/ansible-lint/contents/docs/requirements.in?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:23 * authenticating github api request
proxy | 2020/07/01 13:46:24 200 https://api.github.com:443/repos/ansible/ansible-lint/contents/docs/requirements.in?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:24 GET https://api.github.com:443/repos/ansible/ansible-lint/contents/docs/_static?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:24 * authenticating github api request
proxy | 2020/07/01 13:46:24 200 https://api.github.com:443/repos/ansible/ansible-lint/contents/docs/_static?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:24 GET https://api.github.com:443/repos/ansible/ansible-lint/contents/?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:24 * authenticating github api request
proxy | 2020/07/01 13:46:24 200 https://api.github.com:443/repos/ansible/ansible-lint/contents/?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
updater | ERROR Error during file fetching; aborting
updater | INFO Finished job processing
updater | time="2020-07-01T13:46:24Z" level=info msg="task complete" container_id=job-32913527-file-fetcher exit_code=0 job_id=32913527 step=fetcher
updater | time="2020-07-01T13:46:24Z" level=warning msg="failed during fetch, skipping updater" job_id=32913527
```
Contributor guide
Research direction
Start by reproducing the pip/pip-tools case with the requirements.in reference to requirements.txt and review the file-fetch failure shown in the updater log. Verify the fix against manifests containing -c requirements.txt; done means Dependabot updates the locked dependency in requirements.txt instead of skipping the updater.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100