dependabot / dependabot/dependabot-core

Including constraints refs in `requirements.in` makes dependabot skip updates

Open
#2,272 12 comments 17 reactions 0 assignees View on GitHub
core 🍏 F: configuration-file L: python:pip T: bug 🐞 versioning
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

When using pip-tools, one of the approaches is to [add `-c requirements.txt` in `requirements.in`](https://github.com/jazzband/pip-tools#workflow-for-layered-requirements).

Also, when using this approach `pip install -r requirements.in` automatically implies `-c requirements.txt`.

Today I experimentally confirmed that dependabot fails to update dependencies in pip-compile managed files whenever they are linked with such a reference.

In one of my projects, I commented out this ref (https://github.com/ansible/pylibssh/commit/79476476d34bc44a1f76e95db1e89bc25aadf83f) and got a PR after that: https://github.com/ansible/pylibssh/pull/83.

It currently uses the "legacy" dependabot-preview GitHub App but in another repo I tried out enabling this new "native beta" and the failure is the same (see the log below).

**Package manage/ecosystem**

pip/pip-tools/pip-compile

**Manifest contents prior to update**

```ini
# requirements.in
-c requirements.txt

Cython
```
```ini
# requirements.txt
...
cython==0.29.14 \
--hash=sha256:...
...
```

**Updated dependency**

None, unfortunatelly.

**What you expected to see, versus what you actually saw**

Lock file updated.

**Images of the diff or a link to the PR, issue or logs**

```console
proxy | time="2020-07-01T13:46:16Z" level=info msg="proxy starting" commit=a56e4b1997517cac92a8e8ad56c1aa52b4c43980
proxy | 2020/07/01 13:46:16 Listening (:1080)
updater | time="2020-07-01T13:46:18Z" level=info msg="guest starting" commit=14149ee5d994baaaf2f4596e5271ad736d482620
updater | time="2020-07-01T13:46:18Z" level=info msg="starting job..." job_id=32913527 updater_version=0.118.5-1ea51cbfa775e14d6bbdf7573e3809d689e16029
updater | yarn config v1.22.4
updater | success Set "cafile" to "/etc/ssl/certs/ca-certificates.crt".
updater | Done in 0.03s.
updater | warning: parser/current is loading parser/ruby26, which recognizes
updater | warning: 2.6.6-compliant syntax, but you are running 2.6.5.
updater | warning: please see https://github.com/whitequark/parser#compatibility-with-ruby-mri.
updater | INFO Starting job processing
proxy | 2020/07/01 13:46:23 GET https://api.github.com:443/repos/ansible/ansible-lint
proxy | 2020/07/01 13:46:23 * authenticating github api request
proxy | 2020/07/01 13:46:23 200 https://api.github.com:443/repos/ansible/ansible-lint
proxy | 2020/07/01 13:46:23 GET https://api.github.com:443/repos/ansible/ansible-lint/git/refs/heads/master
proxy | 2020/07/01 13:46:23 * authenticating github api request
proxy | 2020/07/01 13:46:23 200 https://api.github.com:443/repos/ansible/ansible-lint/git/refs/heads/master
proxy | 2020/07/01 13:46:23 GET https://api.github.com:443/repos/ansible/ansible-lint/contents/docs?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:23 * authenticating github api request
proxy | 2020/07/01 13:46:23 200 https://api.github.com:443/repos/ansible/ansible-lint/contents/docs?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:23 GET https://api.github.com:443/repos/ansible/ansible-lint/contents/docs/requirements.in?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:23 * authenticating github api request
proxy | 2020/07/01 13:46:24 200 https://api.github.com:443/repos/ansible/ansible-lint/contents/docs/requirements.in?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:24 GET https://api.github.com:443/repos/ansible/ansible-lint/contents/docs/_static?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:24 * authenticating github api request
proxy | 2020/07/01 13:46:24 200 https://api.github.com:443/repos/ansible/ansible-lint/contents/docs/_static?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:24 GET https://api.github.com:443/repos/ansible/ansible-lint/contents/?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
proxy | 2020/07/01 13:46:24 * authenticating github api request
proxy | 2020/07/01 13:46:24 200 https://api.github.com:443/repos/ansible/ansible-lint/contents/?ref=09f62df2ef977bda98a596f54a139f0aa5003b1f
updater | ERROR Error during file fetching; aborting
updater | INFO Finished job processing
updater | time="2020-07-01T13:46:24Z" level=info msg="task complete" container_id=job-32913527-file-fetcher exit_code=0 job_id=32913527 step=fetcher
updater | time="2020-07-01T13:46:24Z" level=warning msg="failed during fetch, skipping updater" job_id=32913527
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the pip/pip-tools case with the requirements.in reference to requirements.txt and review the file-fetch failure shown in the updater log. Verify the fix against manifests containing -c requirements.txt; done means Dependabot updates the locked dependency in requirements.txt instead of skipping the updater.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.