Dependabot requires private repo auth when it is unnecessary about dependabot-core HOT 4 OPEN

Hi @Nishnha - here is a job ID: 827058885

I was able to do the same work that Dependabot should try to do without any authorization by simply relying on updating the public depndencies.

from dependabot-core.

To clarify some thing here, this is probably due to Dependabot trying to install deps before doing the update. As I see it currently, dependabot is using --lock on the actual update command. But there is no need to actually install packages beforehand, or create a venv at all to do the update. But Dependabot is obviously using a venv.

e.g.

% pip freeze
% poetry update sqlparse --lock --no-interaction
Updating dependencies
Resolving dependencies... (1.9s)

Writing lock file

from dependabot-core.

Hi @mbrancato I'll try to get some eyes on this. Do you have an example that you could share that reproduces this, or the job ID of a job that shows this behavior? The job ID should be printed out in the job logs.

from dependabot-core.

related:

• #8554
• #8020
• #7940
• #7440

from dependabot-core.