Newly enabled grouped updates PR not closing out old/superseded single dependency PRs

[edmorley]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Cargo

Package manager version

1.73

Language version

1.73

Manifest location and content before the Dependabot update

https://github.com/heroku/buildpacks-ruby/blob/cdc74536fd2e8bee9d69923dab34882af2eae01d/Cargo.toml
https://github.com/heroku/buildpacks-ruby/blob/cdc74536fd2e8bee9d69923dab34882af2eae01d/buildpacks/ruby/Cargo.toml
https://github.com/heroku/buildpacks-ruby/blob/cdc74536fd2e8bee9d69923dab34882af2eae01d/commons/Cargo.toml
https://github.com/heroku/buildpacks-ruby/blob/cdc74536fd2e8bee9d69923dab34882af2eae01d/Cargo.lock

(Repo is using Cargo workspaces)

dependabot.yml content

https://github.com/heroku/buildpacks-ruby/blob/cdc74536fd2e8bee9d69923dab34882af2eae01d/.github/dependabot.yml

Updated dependency

Newly opened grouped updates PR:
heroku/buildpacks-ruby#219

PRs that should have been superseded and thus closed:
heroku/buildpacks-ruby#206
heroku/buildpacks-ruby#212
heroku/buildpacks-ruby#213

What you expected to see, versus what you actually saw

For any old/superseded single dependency PRs (where the single package being updated by the PR is now included within the newly opened group dependency update PR) to be closed automatically by Dependabot.

Triggering a manual Dependabot re-run (via insights tab) didn't help.

Neither did commenting on the old PRs with @dependabot recreate.

Note: Strangely Dependabot did close out this old/superseded single-dependency PR on the same repo: heroku/buildpacks-ruby#214 - no idea why it worked for that PR and not the others.

Native package manager behavior

N/A

Images of the diff or a link to the PR, issue, or logs

The most recent main Dependabot version update retrigger:
https://github.com/heroku/buildpacks-ruby/network/updates/732604193

And the most recent Dependabot rebase runs for the affected single-dependency PRs:
https://github.com/heroku/buildpacks-ruby/network/updates/732604851
https://github.com/heroku/buildpacks-ruby/network/updates/732604817
https://github.com/heroku/buildpacks-ruby/network/updates/732603006

Smallest manifest that reproduces the issue

No response

[jakecoffman]

I just shipped a fix for this. Going forward a new grouped PR should close out the single PRs if they have the same dependency updated.

Thanks for filing these issues!

[edmorley]

Thank you for the fix - retriggering a Dependabot run now resulted in the stale PRs being successfully closed :-)