Dependabot does no longer close unnecessary PRs automatically

[mpdude]

When Dependabot creates a PR for a particular update, and that update happens on the target branch by other means (manual update, for example), Dependabot will not automatically recognize this and close the PR.

Commenting @dependabot rebase works in this case, the PR is recognized as being no longer necessary. This is, however, not a practical solution when a lot of PRs have been opened.

I've seen #3782 which is about automatically rebasing Dependabot PRs. This is, however, not exactly the same: I don't need the rebase per se, and it would be a waste of resources 🌱 to run the rebase and subsequent workflows for every push to the target branch.

#3782 also mentions that Dependabot Native would do an automatic rebase in case of merge conflicts for the PR. But, when the manual update and the PR update to the same version of a dependency, often there is no such merge conflict, since the relevant lines in the lockfile (yarn.lock, composer.lock, ...) are the same on the target and base branch.

Previous behavior in Dependabot Preview:

I have already migrated away from Dependabot Preview and so I cannot try it again, but I am relatively sure that Dependabot Preview would immediately notice pushes to the the target branch and react accordingly.

[koichirose]

If I may add on this, it happens for JS dependencies on many of my repos, but not for other languages (ex. PHP) where changes are detected and PRs are automatically closed correctly. As stated above, PRs are closed by issuing @dependabot rebase manually.

[jeffwidman]

Can anyone provide an example?

I have a hunch this is actually working as expected and "trying" to close the PR's, but runs into some other error when parsing certain lockfiles and then bombs out. That would explain why it works for some ecosystems but fails on others. The rebase command would force a rebase, probably skipping the codepath that is evaluating the changes/bombing out.

[jeffwidman]

Closing due to lack of response and suspicion there's another root cause.