You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
+------------------------------------------------------------------------+
| Changes to Dependabot Pull Requests |
+---------+--------------------------------------------------------------+
| created | types-setuptools ( from 80.9.0.20250801 to 80.9.0.20250809 ) |
| created | hypothesis ( from 6.135.26 to 6.137.2 ) |
+---------+--------------------------------------------------------------+
The 🔒 rule matches branches with a **/* pattern (so all except the main and version branches which have their own rules)
It has the following checked:
Dependabot cannot be added to the allowlist, it doesn't show up when typing "dependabot" / "Dependabot" in the box (on the contrary, bedevere-bot, miss-islington, miss-islington-app and hugovk do autocomplete there).
Creating a temp team to see if we can add Dependabot via that:
Perhaps if we add Dependabot to this org we can then either directly add it to the **/* allowlist?
Dependabot cannot be added to the allowlist, it doesn't show up when typing "dependabot" / "Dependabot" in the box (on the contrary, bedevere-bot, miss-islington, miss-islington-app and hugovk do autocomplete there).
When I was looking at PRs created by Dependabot, I realized that you have to reference him by app/dependabot on GitHub, not just dependabot.
We could maybe add a new dependabot/** rule. I do like the fact that there's no branch clutter in the repo, though.
Dependabot can only create branches in upstream, and not forks.
On mobile now, but this is the key thing -- if there's a configuration for dependabot to use a fork (even one we control), it would solve these problems.
Could we somehow get Bedevere to do it? I'm thinking we could set up Dependabot on a forked repository, and then have Bedevere (or some other bot) simply relay those changes to a CPython PR.
FTR, here's how I manage rulesets these days — separate per-function updates + allowing branches created by certain apps (and some personal exclusions sometimes):
By the way @davidism's got https://gha-update.rtfd.io which is a CLI tool to make action bumps in workflow and action definitions. It can be used to manage updates semi-manually or integrated into a home-grown automation.
@ambv could you add a bypass entry to the rulesets that block branch creation? It should end up looking like "Dependabot [App] github.com" at the top of the screenshot above.
Once done, we can test that it works even without adding app-specific branch patterns. This would be a short-term solution. And then, long-term, we'd consider integrating Renovate in its forking mode which would fullfil the requirement of not polluting upstream with temporary bot branches. We could also go to extremes and self-host the app but I don't see this being necessary.
Activity
ZeroIntensity commentedon Aug 11, 2025
I found this article from GitHub: https://docs.github.com/en/code-security/dependabot/troubleshooting-dependabot/dependabot-updates-stopped. Based on that, I think one of the @python/cpython-repository-admins need to deal with it in settings.
AA-Turner commentedon Aug 11, 2025
The bot is still responding on a random old PR: #122717, and the workflow has recent runs: https://github.com/python/cpython/actions/workflows/dependabot/dependabot-updates
AA-Turner commentedon Aug 11, 2025
@dependabot update
ZeroIntensity commentedon Aug 11, 2025
@bedevere-bot as a fellow robot can you tell @dependabot to give us update PRs
AA-Turner commentedon Aug 11, 2025
Ahh, I've found the (some of) the logs: https://github.com/python/cpython/network/updates/1066103475
It's trying to create a branch directly on
python/cpython, not a fork, which we've banned.A
AA-Turner commentedon Aug 11, 2025
We can manually trigger it through https://github.com/python/cpython/network/updates (the "Check for updates" button)
AA-Turner commentedon Aug 11, 2025
Updating github-actions failed
Logs
Updating Tools/requirements*.txt succeeded/failed, it thinks it created a PR but then the network tab reports that PR creation failed.
hugovk commentedon Aug 12, 2025
Network error?
Clicking "Check for updates" ran a new one semi-successfully:
https://github.com/python/cpython/actions/runs/16904270764/job/47890267885
But we get again get "Dependabot failed to create a pull request", which as mentioned, is banned, so not surprising.
**/*pattern (so all except themainand version branches which have their own rules)**/*allowlist?ZeroIntensity commentedon Aug 12, 2025
When I was looking at PRs created by Dependabot, I realized that you have to reference him by
app/dependaboton GitHub, not justdependabot.AA-Turner commentedon Aug 12, 2025
We could maybe add a new
dependabot/**rule. I do like the fact that there's no branch clutter in the repo, though.On mobile now, but this is the key thing -- if there's a configuration for dependabot to use a fork (even one we control), it would solve these problems.
ZeroIntensity commentedon Aug 12, 2025
Could we somehow get Bedevere to do it? I'm thinking we could set up Dependabot on a forked repository, and then have Bedevere (or some other bot) simply relay those changes to a CPython PR.
shenxianpeng commentedon Aug 16, 2025
Just a small thought — adding a new
dependabot/**rule should work, and it’s not a big deal since it will be removed automatically after the merge.ZeroIntensity commentedon Aug 16, 2025
I would prefer not to:
git fetch --allis run.11 remaining items
webknjaz commentedon Jan 21, 2026
FTR, here's how I manage rulesets these days — separate per-function updates + allowing branches created by certain apps (and some personal exclusions sometimes):
By the way @davidism's got https://gha-update.rtfd.io which is a CLI tool to make action bumps in workflow and action definitions. It can be used to manage updates semi-manually or integrated into a home-grown automation.
webknjaz commentedon Jan 21, 2026
@hugovk apparently, they've got a solution for this: https://docs.renovatebot.com/getting-started/running/#forking-renovate-app / https://github.com/apps/forking-renovate. Though, it looks underdocumented currently: renovatebot/renovate#40574.
webknjaz commentedon Jan 21, 2026
@ambv could you add a bypass entry to the rulesets that block branch creation? It should end up looking like "
Dependabot [App] github.com" at the top of the screenshot above.Once done, we can test that it works even without adding app-specific branch patterns. This would be a short-term solution. And then, long-term, we'd consider integrating Renovate in its forking mode which would fullfil the requirement of not polluting upstream with temporary bot branches. We could also go to extremes and self-host the app but I don't see this being necessary.
webknjaz commentedon Feb 11, 2026
@ambv I've just confirmed that the bypass solution works on another project. Could you add
Dependabotto the bypass list in the respective ruleset?StanFromIreland commentedon Mar 14, 2026
Dependabot is back, e.g. #145946!
StanFromIreland commentedon Mar 14, 2026
I wrote #145947 to group the updates.
hugovk commentedon Mar 14, 2026
I replaced some old rules with new rulesets which allow Dependabot to create branches.
actions/checkout@v6andactions/setup-python@v6to avoid the deprecated warning in capi-docs checking #145941 as a duplicate of this issuegh-137650: Group dependabot actions updates (#145947)
pythongh-137650: Group dependabot actions updates (python#145947)