Dependabot updating dependencies from wrong package manager

[amogkam]

We have recently added Dependabot for our repo and want to do pip updates only, but Dependabot is updating Java dependencies as well even though this is not configured.

Our dependabot.yml file looks like this:

version: 2
updates:
  # Tune/SGD/Doc requirements
  - package-ecosystem: "pip"
    # The requirements base directory currently only contains tune requirements.
    # If we want to add more requirements here (Core, RLlib, etc.), then we should make subdirectories for each one.
    directory: "/python/requirements"
    schedule:
      # TODO(amogkam) change this to weekly after some initial validation.
      interval: "daily"
      # 8 PM
      time: "20:00"
      # Use Pacific Standard Time
      timezone: "America/Los_Angeles"
    commit-message:
      prefix: "[tune]"
      include: "scope"
    # Only 3 upgrade PRs at a time.
    open-pull-requests-limit: 3
    reviewers:
      - "ray-project/ray-tune"

Only pip updates should be setup, but Dependabot has been creating PRs for Java updates and in a different directory than what's specified here.
ray-project/ray#13316
ray-project/ray#13317

Is there anything that's wrong with our yaml file? If Java package manager is not configured I would expect Dependabot not to make any PRs to update the Java dependencies.

[amogkam]

Also the Dependabot tab on the repo is only showing Python, so it's very odd why it's updating Java dependencies as well.

[qnighy]

I'm also getting npm/yarn updates for a repository where only gomod and docker updates are enabled.

[feelepxyz]

@amogkam it looks like those PRs are from Dependabot security updates which where generated from the dependabot alert page under the repository security tab. You can also disable automated security updates from the repo settings > security & analysis page (or for all repos from org settings > security & analysis settings).

We're aware of the issue between configuring version updates (config file only) which run on a schedule and security updates (triggered from dependabot alerts, both manually for old alerts and automatically when new alerts are found on the repo). We have some plans to improve this in the future.

[amogkam]

@feelepxyz are Dependabot security updates automatically enabled? We never enabled it manually.

[amogkam]

Also, these security update PRs are still considered as part of the 3 open PRs quota that we have set in the dependabot.yaml file. Is that expected? Or are security updates supposed to be completely separate from version updates?

[amogkam]

Ah @feelepxyz never mind about it being automatically enabled. Looks like someone from our side triggered the security update PRs.

[feelepxyz]

Also, these security update PRs are still considered as part of the 3 open PRs quota that we have set in the dependabot.yaml file. Is that expected? Or are security updates supposed to be completely separate from version updates?

No not currently, there's a separate open pull request limit (10) that only applies to automatically opened security updates, you can create any number of security updates if you trigger them manually.