How to skip system dependencies during the pipenv lock process when using Dependabot?

Question

I’ve been using Dependabot to keep my Python packages up to date, but recently it’s been slowing down and not updating as often as I’d like.

After digging into the issue, I found that a specific Python package (gdal) is causing a timeout during the pipenv lock process. This package requires system dependencies that aren’t available to Dependabot. Here’s the traceback:

updater | 2025/01/13 05:50:33 INFO <job_946697243> Handled error whilst updating werkzeug: 
dependency_file_not_resolvable {:message=>"Pipenv failed to install \"gdal~=3.6.2\". 
This could be caused by missing system dependencies that can't be installed by Dependabot 
or required installation flags.\n\nError output from running \"pipenv lock\"
:\nERROR:pip.subprocessor:python setup.py egg_info exited with 1\nTraceback
(most recent call last):\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/operations/build/metadata_legacy.py\", line 64,
in generate_metadata\n    call_subprocess(\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/utils/subprocess.py\", line 224, in call_subprocess\n    raise 
error\npipenv.patched.pip._internal.exceptions.InstallationSubprocessError: python setup.py egg_info
 exited with 1\nThe above exception was the direct cause of the following exception:\nTraceback 
(most recent call last):\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages
/pipenv/utils/resolver.py\", line 443, in resolve\n    results = resolver.resolve(constraints,
 check_supported_wheels=False)\n              
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/
_internal/resolution/resolvelib/resolver.py\", line 95, in resolve\n    result = self._result = resolver.resolve(\n
  ^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_vendor/resolvelib/resolvers.py\", line 546, in resolve\n
state = resolution.resolve(requirements, max_rounds=max_rounds)\n            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File
\"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_vendor
/resolvelib/resolvers.py\", line 397, in resolve\n    self._add_to_criteria(self.state.criteria, r, parent=None)
\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_vendor/
resolvelib/resolvers.py\", line 173, in _add_to_criteria\n    if not criterion.candidates:\n  File
\"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_vendor/
resolvelib/structs.py\", line 156, in __bool__\n    return bool(self._sequence)
\n^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/resolution/resolvelib/found_candidates.py\", line 155,
in __bool__\n    return any(self)\n           ^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/
3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/
found_candidates.py\", line 143, in <genexpr>\n    return (c for c in iterator if id(c)
 not in self._incompatible_ids)\n 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/resolution/resolvelib/found_candidates.py\",
 line 47, in _iter_built\n    candidate = func()\n                ^^^^^^\n  File \"/usr/local/
.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/
resolution/resolvelib/factory.py\", line 182, in _make_candidate_from_link\n
base: Optional[BaseCandidate] = self._make_base_candidate_from_link(\n                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/
3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/
factory.py\", line 228, in _make_base_candidate_from_link\n    
self._link_candidate_cache = LinkCandidate(\n ^^^^^^^^^^^^^^\n  
File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/candidates.py\",
 line 294, in __init__\n    super().__init__(\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/candidates.py\", line 157,
 in __init__\n    self.dist = self._prepare()\n                ^^^^^^^^^^^^^^^\n  File
 \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/candidates.py\", line 223,
in _prepare\n    dist = self._prepare_distribution()\n 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/resolution/resolvelib/candidates.py\", line 305,
in _prepare_distribution\n    return preparer.prepare_linked_requirement(self._ireq, parallel_builds=True)\n
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File 
\"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/
_internal/operations/prepare.py\", line 525, in prepare_linked_requirement\n    
return self._prepare_linked_requirement(req, parallel_builds)\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File
\"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip
/_internal/operations/prepare.py\", line 640, in _prepare_linked_requirement\n    dist = _get_prepared_distribution(\n  
^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-packages/pipenv/patched/pip/_internal/operations/prepare.py\", line 71, in _get_prepared_distribution\n
abstract_dist.prepare_distribution_metadata(\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/distributions/sdist.py\", line 67, in prepare_distribution_metadata\n
self.req.prepare_metadata()\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/req/req_install.py\", line 586, in prepare_metadata
\n    self.metadata_directory = generate_metadata_legacy(\n                              
^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/local/.pyenv/versions/3.11.9/lib/python3.11/site-
packages/pipenv/patched/pip/_internal/operations/build/metadata_legacy.py\", line 71, in generate_metadata\n
raise MetadataGenerationFailed(package_details=details) from
error\npipenv.patched.pip._internal.exceptions.MetadataGenerationFailed: metadata generation failed"}

And the dependabot.yml config file

version: 2
updates:
- package-ecosystem: pip
  directory: "/"
  schedule:
    interval: daily
    time: "04:00"
  open-pull-requests-limit: 10
  allow:
  - dependency-type: direct
  - dependency-type: indirect

I tried skipping the dependency via the dependabot.yml, but unfortunately, it doesn’t skip the dependencies during the pipenv lock process that Dependabot executes. I also tried locking the version, but since the error occurs during the pipenv lock process, that doesn’t work either. Is there a way to configure the Pipfile to skip system dependencies during lockfile creation, or to tell Dependabot to skip them?