[Python-Dev] Re: github and dependabot

On Mon, May 3, 2021 at 9:15 PM Łukasz Langa wrote:

It's bogus automation, you can safely reject those pull requests. If you do merge any pull requests to `main` of your personal fork, your `main` branch will diverge from python/cpython's. Not recommended.

I just merged the equivalent pull requests from dependabot on python/cpython. You can pull from upstream.

- Ł

...

On 4 May 2021, at 02:59, Ethan Furman wrote:

I have two pull requests against my cpython fork from a dependabot -- what is that, and should I merge them?

-- ~Ethan~

This is a known issue on GitHub's end, specifically that disabling Dependabot on a fork is broken: https://github.com/dependabot/dependabot-core/issues/2804 (note that a comment specifically about the impact on CPython exists there as well). The only workaround at the moment is to delete and recreate your fork, after which Dependabot should be disabled so long as you never touch the setting again.