Open tociepka-clgx opened 1 month ago
Unfortunately I cannot reproduce this because i do not have access to that repository. Maybe the dependabot staff can
In the meantime, if you can create a public reproducer maybe I can take a look
Hi @yeikel . I've managed to reproduce the issue on a public repository. I hope it helps!
Hi @yeikel . I've managed to reproduce the issue on a public repository. I hope it helps!
Hi @tociepka-clgx
Thank you for trying to set a reproducer
Unfortunately, I see a 404 page when I try to navigate to that page. Could you please make it public and/or give me read access?
@yeikel
Hi @yeikel . I've managed to reproduce the issue on a public repository. I hope it helps!
Hi @tociepka-clgx
Thank you for trying to set a reproducer
Unfortunately, I see a 404 page when I try to navigate to that page. Could you please make it public and/or give me read access?
I can't find a way to give everyone access to insights/dependabot page so I gave you collaborator rights. Also one can clone this repo to reproduce this issue.
@yeikel
Hi @yeikel . I've managed to reproduce the issue on a public repository. I hope it helps!
Hi @tociepka-clgx
Thank you for trying to set a reproducer
Unfortunately, I see a 404 page when I try to navigate to that page. Could you please make it public and/or give me read access?
I can't find a way to give everyone access to insights/dependabot page so I gave you collaborator rights. Also one can clone this repo to reproduce this issue.
Oh, I see what my mistake was. Cons of using GitHub mobile :)
I can see the repo but not the dependabot alerts, but that's fine
I'll try to reproduce it and get back to you sometime today
Apologies for the delay, based on the logs and looking closely at your pom file, it seems that the issue is this part of your pom
<profile>
<id>customBuild</id>
<activation>
<property>
<name>profile</name>
<value>customBuild</value>
</property>
</activation>
<modules>
<module>${modulesToBuild}</module>
</modules>
</profile>
</profiles>
In particular, this part <module>${modulesToBuild}</module>
is something that dependabot is failing to parse as that's not a real module
I am not aware of any workaround right now besides removing that from your pom. I'll look into a fix though
tociepka-clgx/dependabot-issue@f2e9e91 confirmed my suspicions
Thanks for looking into the problem. However we need this profile for our jenkins pipelines. I guess the simplest way to fix this problem would be to treat this parsing error as warning? I don't understand why it is necessary to parse all the profiles anyway.
Is there an existing issue for this?
Package ecosystem
maven
Package manager version
3.6.3
Language version
Java 11
Manifest location and content before the Dependabot update
https://github.com/corelogic-private/tax_us-owf-one_workflow/blob/master/pom.xml
dependabot.yml content
https://github.com/corelogic-private/tax_us-owf-one_workflow/blob/master/.github/dependabot.yml
Updated dependency
No response
What you expected to see, versus what you actually saw
I expected dependabot to make a pull requests to update vulnerable dependencies, but instead I'm getting 'couldn't find a pom.xml" error.![image](https://github.com/user-attachments/assets/813257bf-fb69-4555-9308-9520e96c65a2)
Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
logs:
Smallest manifest that reproduces the issue
repo