Dependabot times out due to not finding system dependancies

[freshavocado7]

Hi,

We use Dependabot to update our Python packages, but recently, Dependabot has been slowing down and not updating as frequently as we’d like.

After investigating the issue, we discovered that a specific Python package was causing a timeout during the pipenv lock process. This package requires system dependencies that are unavailable to Dependabot. Although the Dependabot YAML config supports skipping dependencies, it does not skip them while trying to build the lockfile. Below is the traceback:

updater | 2025/01/13 05:50:33 INFO <job_946697243> Handled error whilst updating werkzeug: 
dependency_file_not_resolvable {:message=>"Pipenv failed to install \"gdal~=3.6.2\". 
This could be caused by missing system dependencies that can't be installed by Dependabot 
or required installation flags.\n\nError output from running \"pipenv lock\"
:\nERROR:pip.subprocessor:python setup.py egg_info exited with 1\nTraceback
(most recent call last):\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/operations/build/metadata_legacy.py\", line 64,
in generate_metadata\n    call_subprocess(\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/utils/subprocess.py\", line 224, in call_subprocess\n    raise 
error\npipenv.patched.pip._internal.exceptions.InstallationSubprocessError: python setup.py egg_info
 exited with 1\nThe above exception was the direct cause of the following exception:\nTraceback 
(most recent call last):\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages
/pipenv/utils/resolver.py\", line 443, in resolve\n    results = resolver.resolve(constraints,
 check_supported_wheels=False)\n              
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/
_internal/resolution/resolvelib/resolver.py\", line 95, in resolve\n    result = self._result = resolver.resolve(\n
  ^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_vendor/resolvelib/resolvers.py\", line 546, in resolve\n
state = resolution.resolve(requirements, max_rounds=max_rounds)\n            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File
\"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_vendor
/resolvelib/resolvers.py\", line 397, in resolve\n    self._add_to_criteria(self.state.criteria, r, parent=None)
\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_vendor/
resolvelib/resolvers.py\", line 173, in _add_to_criteria\n    if not criterion.candidates:\n  File
\"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_vendor/
resolvelib/structs.py\", line 156, in __bool__\n    return bool(self._sequence)
\n^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/resolution/resolvelib/found_candidates.py\", line 155,
in __bool__\n    return any(self)\n           ^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/
3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/
found_candidates.py\", line 143, in <genexpr>\n    return (c for c in iterator if id(c)
 not in self._incompatible_ids)\n 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/resolution/resolvelib/found_candidates.py\",
 line 47, in _iter_built\n    candidate = func()\n                ^^^^^^\n  File \"/usr/local/
.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/
resolution/resolvelib/factory.py\", line 182, in _make_candidate_from_link\n
base: Optional[BaseCandidate] = self._make_base_candidate_from_link(\n                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/
3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/
factory.py\", line 228, in _make_base_candidate_from_link\n    
self._link_candidate_cache = LinkCandidate(\n ^^^^^^^^^^^^^^\n  
File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/candidates.py\",
 line 294, in __init__\n    super().__init__(\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/candidates.py\", line 157,
 in __init__\n    self.dist = self._prepare()\n                ^^^^^^^^^^^^^^^\n  File
 \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/candidates.py\", line 223,
in _prepare\n    dist = self._prepare_distribution()\n 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/candidates.py\", line 305,
in _prepare_distribution\n    return preparer.prepare_linked_requirement(self._ireq, parallel_builds=True)\n
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File 
\"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/
_internal/operations/prepare.py\", line 525, in prepare_linked_requirement\n    
return self._prepare_linked_requirement(req, parallel_builds)\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File
\"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip
/_internal/operations/prepare.py\", line 640, in _prepare_linked_requirement\n    dist = _get_prepared_distribution(\n  
^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/operations/prepare.py\", line 71, in _get_prepared_distribution\n
abstract_dist.prepare_distribution_metadata(\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/distributions/sdist.py\", line 67, in prepare_distribution_metadata\n
self.req.prepare_metadata()\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/req/req_install.py\", line 586, in prepare_metadata
\n    self.metadata_directory = generate_metadata_legacy(\n                              
^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/operations/build/metadata_legacy.py\", line 71, in generate_metadata\n
raise MetadataGenerationFailed(package_details=details) from
error\npipenv.patched.pip._internal.exceptions.MetadataGenerationFailed: metadata generation failed"}

And the dependabot.yml config file

version: 2
updates:
- package-ecosystem: pip
  directory: "/"
  schedule:
    interval: daily
    time: "04:00"
  open-pull-requests-limit: 10
  allow:
  - dependency-type: direct
  - dependency-type: indirect

What would be the best approach for this? Or is it something that should be discussed in the pyenv repository instead of here?