Unexpected dependabot updates with pip-compile

[pamelafox]

Select Topic Area

Question

Body

Please see this dependabot PR:
Azure-Samples/azure-search-openai-demo#939

It attempts to update fixedint to 0.2.0, even though the parent package "azure-monitor-opentelemetry-exporter" specifically pins 0.1.6, as you can see here:

https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/monitor/azure-monitor-opentelemetry-exporter/setup.py

When I manually run pip-compile --upgrade locally, it does not attempt to make this change. This seems like a buggy behavior.

[pamelafox]

Filed @ dependabot/dependabot-core#8381

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬