"Dependabot updates are paused" because "you haven't used Dependabot in a while"

[alexpdp7]

Select Topic Area

Bug

Body

Hi,

Dependabot updates to my repo https://github.com/alexpdp7/ragent/ show this message. The message prompts me to merge Dependabot PRs to resume, but I have no open Dependabot PRs.

I think this happens become commonly, I merge many Dependabot PRs into a main PR, then run cargo update, then prepare my repo for a release. As the original PRs are not merged, perhaps Dependabot thinks I'm not paying attention? (I am!)

Cheers,

Álex

[jeffwidman]

👋 Glad you like

I think the problem here is that you're cherry-picking the commits into your final PR... but not the Dependabot PR's... so thinks there's no user activity on its PRs.

You could probably change the base on one or more of the Dependabot PR's after they're generated so you can merge that Dependabot PR into your staging branch? Then it'll look like activity to Dependabot and prevent getting paused.

To kickstart it again, you can still manually trigger version updates to run to get another PR or maybe toggle security updates off/on to unpause... I'm not sure, but that should get it going enough to unstuck that repo.

[alexpdp7]

That's cool. Everything below here is "subjective", so make of it what you will.

I've seen people "complain" that merging many Dependabot PRs is a chore. Esp. depending on your repo configuration, you might need to merge, wait for another Dependabot to rebase, then merge that, etc. If your builds are slow, this can be quite painful.

As I have a repo which requires 1h to build (it does crosscompilation using Qemu), I adopted the practice of batching Dependabot PRs a bit; I create a branch and merge a couple of Dependabot PRs. That's much more efficient for me. Another nice thing is that I do a merge squash and then the nice commit messages for Dependabot are combined. I also frequently push a few more commits with stuff required to make a new release, or other misc. maintenance tasks.

At some point in the future, you may want to consider having this "batching" functionality built in Dependabot (although GitHub could also implement this). Tell Dependabot to combine a few of its PRs into one. This doesn't sound like anything that might be close in your roadmap, but I think it'd be interesting to steer people into doing this manually (this might end up saving some resources to Dependabot!).

In any case, I think you've got this thought out, so no worries- once I know what I need to do, I think I can work around this without much trouble, so feel free to "archive" this conversation.

[jeffwidman]

You may wish to subscribe to this issue for updates:

• Add grouped updates dependabot/dependabot-core#1190

(and see the last few entries on that thread 🎉 )

[bomgar]

I have the same problem. Is there any way to manually reactivate it?
I use dependabot to receive notification about new version. But I don't merge individual PRs. The grouped feature would work.

[tyranron]

@bomgar yeah, there are some the ways: https://github.blog/2023-01-12-a-smarter-quieter-dependabot/#how-do-i-wake-dependabot-up

For me, updating the dependabot.yml file did the trick.

[jpmckinney]

I'm facing this issue. There seems to be no way to unpause Dependabot alerts. I have no open Dependabot PRs. I tried disabling and re-enabling Dependency graph, Dependabot alerts, and Dependabot security updates. I tried doing @dependabot in a previously merged PR and also an unmerged PR (where I had merged manually only twice).

Is there no way to unpause Dependabot?