Production dependencies not getting updated by Dependabot #964
Comments
|
Simple workarounds:
Also worth noting that pydocstyle will use the standard library More complicated workaround:
|
StevenMaude
changed the title
StevenMaude
changed the title
StevenMaude
changed the title
|
Other weird features of this issue:
|
|
I think this is a relevant issue: dependabot/dependabot-core#6550 And I think it also affects a few other of our repositories. |
|
The linked Dependabot issue is fixed, so we don't get the:
any longer. Nor do we don't get associated errors in the panel that shows "last checked" for But I'm still not convinced think it is entirely working, because we still don't get updates for the out-of-date dependencies. |
Dependabot keeps failing on this, for whatever reason. Maybe this will unblock Dependabot from being able to upgrade production dependencies? (See #964.)
Dependabot keeps failing on this, for whatever reason, in the following way: ``` updater | INFO <job_621493460> Latest version is 0.18.3 updater | INFO <job_621493460> Requirements to unlock own updater | INFO <job_621493460> Requirements update strategy bump_versions updater | INFO <job_621493460> Updating future from 0.18.2 to 0.18.3 … updater | ERROR <job_621493460> Error processing future (RuntimeError) updater | ERROR <job_621493460> No files have changed! ``` Maybe this will unblock Dependabot from being able to upgrade production dependencies? (See #964.)
|
In fact, if you look at Dependabot's version update log, it doesn't even check the production requirements at all. There's no "No update needed" for any of the production requirements. I think this Dependabot issue might be related, or it's something similar (Dependabot just picks one update ecosystem and use that; so it updates the requirements based on the It might also be worth trying to ditch the |
Ooh, this looks nice. |
|
Moving everything into
|
That is, it works to get Dependabot back up and checking dependencies. There's then an issue with transitive dependencies seemingly not being updated. So, the update of the virtualenv package fails because distlib (introduced via virtualenv) doesn't get bumped. |
|
Other related Dependabot issues on not updating Python dependencies from different sources: |
Because Dependabot isn't quite working properly: see #964.
|
For now, I've suggested a manual update so at least things are back up to date again: #1156. |
Dependabot still doesn't do this for us and I'm not sure we've yet figured out why, see: #964 We can do this manually with: pip-compile -U \ --allow-unsafe --generate-hashes --output-file=requirements.prod.txt \ pyproject.toml
Dependabot still doesn't do this for us and I'm not sure we've yet figured out why, see: #964 We can do this manually with: pip-compile -U \ --allow-unsafe --generate-hashes --output-file=requirements.prod.txt \ pyproject.toml
Dependabot still isn't doing this for us (see #964).
Dependabot still isn't doing this for us (see #964).
Dependabot still isn't doing this for us (see #964).
Relates to the past issue #579.
We currently have quite outdated dependencies.
Dependabot is currently failing on
pyproject.toml:We have this dependency because we have a pydocstyle configuration in
pyproject.toml.Running
pip-compilelocally does work though, but maybe there's some difference in my local setup compared with Dependabot 🤷♂️The text was updated successfully, but these errors were encountered: