Open pexa-ashek opened 2 months ago
Seeing similar behavior when dependabot attempted to create PR for high security patches - updating django from 4.2.13 to 4.2.14. We use pipenv (Pipfile, Pipfile.lock).
updater | 2024/07/11 10:58:49 INFO <job_854489083> Starting job processing
updater | 2024/07/11 10:58:53 WARN <job_854489083> Please check your configuration as there are groups where no dependencies match:
- pip
This can happen if:
- the group's 'pattern' rules are misspelled
- your configuration's 'allow' rules do not permit any of the dependencies that match the group
- the dependencies that match the group rules have been removed from your project
- .
- .
- .....
- 2024/07/11 10:58:53 INFO <job_854489083> Found 1 group(s).
updater | 2024/07/11 10:58:53 WARN <job_854489083> Skipping update group for 'pip' as it does not match any allowed dependencies.
Is there an existing issue for this?
Package ecosystem
Gradle
Package manager version
8.2.1
Language version
Kotlin
Manifest location and content before the Dependabot update
build.gradle.kts (relevant section)
versions.gradle.kts
dependabot.yml content
What you expected to see, versus what you actually saw
I'm getting the below error when applying the gradle Dependabot configuration (see above) where I'm only interested in major and minor version updates to the specified dependencies in the defined
group
. Am I missing some attributes undergroups
or is the a problem with the pattern regex itselfAdditional question Is Dependabot able to scan the dependency version when the version config file (in my case
versions.gradle.kts
) has been externalised from thebuild.gradle.kts
fileError log