Dependabot ignores "pull-request-branch-name.separator" option

[bm-klara]

Dependabot began to ignore pull-request-branch-name.separator option from YML settings.

Details:

• Dependabot YML file in my repo was not touched last few months
• newly created Pull Request has the wrong branch name separator
• branch name separator option is configured according to the documentation
  Here is my .github/dependabot.yml file content:

version: 2
updates:
- package-ecosystem: bundler
  directory: "/"
  schedule:
    interval: daily
    time: "10:00"
    timezone: Europe/Berlin
  pull-request-branch-name:
    separator: "-"
  target-branch: dependency-updates

Newly created PR with unexpected branch name: (separated by /):

Example of existing PR with expected branch name: (separated by -), created one week ago:

[qbiqing]

Any update on this? Also encountered the same issue

[mctofu]

👋 @bm-klara, the affected PR looks to have been created as part of a security update. Security updates will always target the default branch and your branch separator config only applies to the dependency-updates branch.

There's two options here:

1. Disable security updates so all your update PRs will go through your regular version update flow.
2. Customize the branch separator for security updates. You'll need to add an additional ecosystem config to your dependabot.yml which applies to the default branch (omit) but disables version updates.

version: 2
updates:
- package-ecosystem: bundler
  directory: "/"
  schedule:
    interval: daily
    time: "10:00"
    timezone: Europe/Berlin
  pull-request-branch-name:
    separator: "-"
  target-branch: dependency-updates
- package-ecosystem: bundler
  directory: "/"
  schedule:
    interval: daily
  pull-request-branch-name:
    separator: "-"
  # Disable version updates
  open-pull-requests-limit: 0

[deivid-rodriguez]

A similar case has been reported at #6366, although in that case, the target branch, directory and ecosytem want to be configured equally for both version and security updates. So no workaround for that case at the moment as far as I understand?

[github-actions]

👋 This issue has been marked as stale because it has been open for 2 years with no activity. You can comment on the issue to hold stalebot off for a while, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details.