Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependabot closes PR if not merged before next interval triggers #11439

Open
1 task done
sklakegg opened this issue Jan 29, 2025 · 0 comments
Open
1 task done

Dependabot closes PR if not merged before next interval triggers #11439

sklakegg opened this issue Jan 29, 2025 · 0 comments
Labels
L: java:maven Maven packages via Maven T: bug 🐞 Something isn't working

Comments

@sklakegg
Copy link

sklakegg commented Jan 29, 2025

Is there an existing issue for this?

  • I have searched the existing issues

Package ecosystem

maven

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
updates:
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
      time: "09:51"
      timezone: "Europe/Oslo"
    groups:
      patch-and-minor:
        update-types:
          - "patch"
          - "minor"
      major:
        update-types:
          - "major"

Updated dependency

No response

What you expected to see, versus what you actually saw

With the current dependabot.yaml, we check the dependencies with a daily interval. If there is no current open dependabot PR in the repo, dependabot will create 2 PRs as specified in the groups config.

The next time the interval triggers again, we expect Dependabot to take no action (since dependencies has not changed in this case), or update the current PR if there is any changes.

But instead dependabot closes the PR with the following message: "Looks like these dependencies are no longer updatable, so this is no longer needed." This makes no sense to me, since nothing has changed.

Next interval again, since there is no existing PRs, dependabot creates 2 new PRs again. The cycle continues...

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

Image

Smallest manifest that reproduces the issue

Use the following yaml. Set the time firstly to a few minutes into the feature to trigger the PR creations. Then update the time again to a few mins into the future, and watch dependabot close the PRs. (Same approach used to show the issue in the image)

version: 2
updates:
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
      time: "09:51"
      timezone: "Europe/Oslo"
    groups:
      patch-and-minor:
        update-types:
          - "patch"
          - "minor"
      major:
        update-types:
          - "major"
@sklakegg sklakegg added the T: bug 🐞 Something isn't working label Jan 29, 2025
@github-actions github-actions bot added the L: java:maven Maven packages via Maven label Jan 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
L: java:maven Maven packages via Maven T: bug 🐞 Something isn't working
Projects
Status: No status
Development

No branches or pull requests

1 participant