search

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PR's.
https://docs.github.com/en/code-security/dependabot
MIT License
4.51k stars 938 forks source link

Ignores not being applied for Cargo #6802

Open iajoiner opened 1 year ago

iajoiner commented 1 year ago

Is there an existing issue for this?

Package ecosystem

cargo

Package manager version

cargo 1.67.1

Language version

Rust 1.67.1

Manifest location and content before the Dependabot update

https://github.com/apache/arrow-ballista-python/blob/main/Cargo.toml

dependabot.yml content

https://github.com/apache/arrow-ballista-python/blob/main/.github/dependabot.yml

Updated dependency

datafusion 18.0.0 -> 19.0.0

What you expected to see, versus what you actually saw

It should have been ignored.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

iajoiner commented 1 year ago

This is true in multiple repos such as arrow-ballista, arrow-ballista-python and delta-rs. For some reason the ignored dependencies are not actually ignored.

jeffwidman commented 1 year ago

Oof, that's got to be frustrating.

I wish I could say I've got time to dive into this right now, but reality is that may not happen for a bit due to some of the other larger improvements we've got in flight.

In the meantime you are welcome to use the dry-run script to investigate further. It should be relatively straightforward, just run it within the docker container (see the linked docs), and sprinkle debugger / puts statements through the code as needed to try to track down what's happening.

If you are able to zero in on the problem a bit further, that'd certainly be helpful for whenever we do have time to pick this up...