search

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.56k stars 960 forks source link

Dependabot ignores maven exclusions #9432

Open turing85 opened 4 months ago

turing85 commented 4 months ago

Is there an existing issue for this?

Package ecosystem

maven

Package manager version

maven 3.8.7

Language version

Java 17

Manifest location and content before the Dependabot update

https://github.com/quarkiverse/quarkus-artemis/blob/main/pom.xml https://github.com/quarkiverse/quarkus-artemis/blob/main/build-parent/pom.xml https://github.com/quarkiverse/quarkus-artemis/blob/main/integration-tests/camel-jms/pom.xml

dependabot.yml content

https://github.com/quarkiverse/quarkus-artemis/blob/main/.github/dependabot.yml

Lines of relevance:

Updated dependency

io.quarkus:quarkus-bom:

What you expected to see, versus what you actually saw

Expected:

The pull requests above should not have been opened.

Actual:

The pull requests were opened.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

See above.

Smallest manifest that reproduces the issue

No response

Additional information

lkreimann commented 4 months ago

We have the same issue with JavaScript dependencies in some of our repositories. Unfortunately they are private repositories, so I can't give a lot of details to reproduce this issue.

turing85 commented 3 months ago

Next round of MRs behaved the same:

turing85 commented 3 months ago

It seems that dependabot is aware of the ignore condition, but did not apply it: https://github.com/quarkiverse/quarkus-artemis/pull/481#issuecomment-2048168934

turing85 commented 3 months ago

I dug through the logs of dependabot. The logs say that "All updates for io.quarkus:quarkus-bom were ignored". But, for example, for io.quarkus:quarkus-maven-plugin (which shares its version with io.quarkus:quarkus-bom), the logs do not show such a message. This seems to be the root cause why those dependencies get updated.

turing85 commented 3 months ago

For anyone having the issue: we were able to work around this with this MR: https://github.com/quarkiverse/quarkus-artemis/pull/484. The important part is that we ignore io.quarkus:* instead of only ignoring io.quarkus:quarkus-bom.