Dependabot not ignoring GUI/HPC example directories

[germa89]

Problem

Dependabot keeps opening unwanted PRs to update pinned requirements.txt files in:

• doc/source/examples/extended_examples/gui/requirements.txt
• doc/source/examples/extended_examples/hpc/requirements.txt

These files are intentionally pinned and should never be auto-updated.

---

Attempts to fix

Attempt 1 — Broad exclude-paths (too wide)

• Commit: 5b2eaf00b — Feb 11, 2026
• PR: #4405
• Added exclude-paths: "doc/source/examples/**/*" on root pip entry.
• Too broad; changed in the next attempt.

Attempt 2 — Fix path (leading / bug)

• Commit: 341d78f17 — Feb 17, 2026
• PR: #4418
• Changed path to "/doc/source/examples/extended_examples/**" (leading / was wrong).

Attempt 3 — Fix path again (remove leading /)

• Commit: cfcefe942 — Mar 6, 2026
• PR: #4468
• Fixed to "doc/source/examples/extended_examples/**".

Attempt 4 — Narrow exclude-paths to specific subdirs

• Commit: 743eb0b22 — Mar 30, 2026
• PR: #4511
• Narrowed to gui/** and hpc/** separately.
• Config was correct and present in main.

Leak — PR #4527 opened despite correct exclude-paths

• PR: #4527 — Apr 6, 2026 (closed same day)
• Dependabot still opened a grouped PR updating both gui/requirements.txt and hpc/requirements.txt.
• The exclude-paths was correctly configured in main at this time (confirmed by inspecting base commit 9fcdd2a69).
• Dependabot's own comment on the PR: "The dependabot.yml entry that created this PR has been deleted" — suggesting the PR was queued/scheduled before the config change took effect.
• Root cause: exclude-paths on a root directory: "/" pip entry does not reliably block subdirectory files from grouped PRs.

Attempt 5 — Switch to open-pull-requests-limit: 0

• Commit: 9e2ee53f3 — Apr 6, 2026
• PR: #4528
• Removed exclude-paths; added dedicated entries for gui and hpc directories with open-pull-requests-limit: 0.
• Intended to monitor but not open PRs.

Leak — PR #4577 opened despite open-pull-requests-limit: 0

• PR: #4577 — May 4, 2026 (still open)
• Dependabot opened a PR bumping pillow in the gui directory despite the limit being set to 0.
• Root cause: open-pull-requests-limit: 0 does not prevent the initial scan PR when a new directory entry is added or when Dependabot re-evaluates the config.

---

Current fix (combined approach)

Both mechanisms are now applied simultaneously to provide defense-in-depth:

1. exclude-paths on the root directory: "/" pip entry — prevents the root scan from touching gui/** and hpc/** files.
2. open-pull-requests-limit: 0 on dedicated gui and hpc directory entries — even if Dependabot scans those directories independently, it won't open PRs.

Remaining action: Close PR #4577 manually (the config change won't auto-close it).

---

Open questions

• Whether the combination of both mechanisms is truly sufficient, or whether Dependabot has deeper bugs with these settings.
• If another PR leaks through, consider renaming the files away from patterns Dependabot auto-detects (e.g., requirements_pinned.txt).

---

Related issues

• exclude-paths should also suppress security update PRs dependabot/dependabot-core#14408

[germa89]

@RobPasMue I believe we talked about this. It seems there is an issue with Dependabot.

[RobPasMue]

Maybe your PR fixes it? Just asking. We can talk offline if you want! I remember we mentioned this yeah..

[germa89]

If I ever come back to this, I will contact you. Thank you! :)