Closed nekitdev closed 1 year ago
Have you confirmed that running native poetry
w/o Dependabot works as expected?
Do you have a publicly reproducible example repo?
Also, you may wish to wait until https://github.com/dependabot/dependabot-core/pull/5746 is merged and re-test then... I'm hoping to ship that before the end of the week.
Note to self: if this does turn out to be true, we may wish to instead re-open https://github.com/dependabot/dependabot-core/issues/5296
Seems that the aforementioned PR fixed the issue. Thanks! <3
Awesome! Thanks for letting us know.
Actually, it seems as though dependabot only fetches the [tool.poetry.group.*]
dependencies, without checking them for updates. Sorry for misleading ._.')/
No problem! Can you clarify though? What do you mean by "fetching the dependencies"? Is it something you see in the logs?
I'll reopen this anyways because I'm afraid this is not yet supported.
Yeah, here are the logs for gd.py:
EDIT: from @jeffwidman, I moved the logs to a folding section as they were super long to scroll past
Oh I see what you mean now. Dependencies in groups like "mkdocs" are being fetched from pipy.org
. But I wonder if that's just because they are dependencies of other dependencies not under any group.
Yeah, I actually wonder too.
I'm having this issue as well. I switched to allow: depdency-type: all
as suggested in https://github.com/dependabot/dependabot-core/issues/5811 and it fixed it for me. There's a detrimental side-effect, which is that Dependabot is now creating many many more PRs than it was.
@jgopel I don't see us parsing poetry groups anywhere so I don't know how allow: - dependency-type: all
would fix this. My guess is that some transitive dependencies of yours are also included in some of your groups, so you still get updates for them. But it's not because being included on any groups, but because of being indirect dependencies, which the allow: - dependency-type: all
instruct Dependabot to also update. Does that make sense?
@jgopel I don't see us parsing poetry groups anywhere so I don't know how
allow: - dependency-type: all
would fix this. My guess is that some transitive dependencies of yours are also included in some of your groups, so you still get updates for them. But it's not because being included on any groups, but because of being indirect dependencies, which theallow: - dependency-type: all
instruct Dependabot to also update. Does that make sense?
I understand what you're saying, but I don't think it aligns with what I'm seeing on my end. Unfortunately, the repo in question is private or I'd send it over for you to take a look at, but I should be able to recreate the general setup in a standalone repository. Would that be helpful?
It would be super helpful, yeah!
This should capture it - https://github.com/jgopel/dependabot-poetry-demo/. You'll note that the main group update landed, but then a git rebase --root
broke the PR. If a new version of that dep were to come out, I would expect it to work fine. Important to note here is that there are PRs from the main group, the dev group, and the custom group (named foo).
Thank you, I will check that đź‘Ť.
Of course - thanks for putting time into this. Please let me know if there's any additional context that I can provide.
FYI: As mentioned in #6209, as a workaround, deprecated formats will work.
# new version of poetry / dependabot is NOT detected
[tool.poetry.group.dev.dependencies]
flake8 = "^6.0.0"
# old version of poetry(deprecated) / dependabot is detected
[tool.poetry.dev-dependencies]
flake8 = "^6.0.0"
I'm having the same issue, are there updates on this topic?
No. There are two ways to bypass this issue - rollback to 1.1
syntax or update dependencies in groups by hand.
Thank you for your answer, what I wanted to ask is if there are plans to support the new format in future releases, as we would like to avoid using the deprecated one (for now we will update dependencies by hand).
Well, I do not relate to dependabot team in any way, so I don't know. I also just wait it.
Candidate fix at #6417
I was about to review #6417 but wanted to figure out first why setting allow: - dependency-type: all
is a workaround for this issue, as demonstrated by the example at https://github.com/dependabot/dependabot-core/issues/5766#issuecomment-1287890071, where we can see updates for numpy
in a public repo where numpy
is under a poetry group.
The reason is that we also parse all dependencies in the lockfile, and let them be updated depending on the allow:
configuration. Since numpy
is in the poetry.lock
file, that's why it still gets updated when you use allow: - dependency-type: all
.
Sorry to comment on this old issue, but is allow: - dependency-type: all
required / recommended when using Poetry dependency groups? I'm unclear about what the resolution to this issue was.
but is allow: - dependency-type: all required / recommended when using Poetry dependency groups?
No, if you’re finding that is the case then probably a different bug.
I'm unclear about what the resolution to this issue was.
@sandy-fairsupply the issue was fully resolved and all Poetry dependency groups are tracked by Dependabot. That said, last I checked Dependabot lumps all Poetry group dependencies as “dev” dependencies, I don’t believe there is a way on the Dependabot side to differentiate them.
Is there an existing issue for this?
Feature description
Dependabot seems to ignore dependency groups introduced in poetry@1.2.0, for instance: