Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

pip / Pipenv

Package manager version

pipenv==2024.4.1.

Language version

Python 3.12

Manifest location and content before the Dependabot update

https://github.com/aoyako/dependabot-test/blob/main/Pipfile
Before the update, Pipfile.lock contains requests==2.30.0 in both sections:

default.requests = 2.30.0
develop.requests = 2.30.0

[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
requests = "*"

[dev-packages]
requests = "*"

[requires]
python_version = "3.12"

dependabot.yml content

https://github.com/aoyako/dependabot-test/blob/main/.github/dependabot.yaml

version: 2

updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    allow:
      - dependency-type: "all"
    groups:
      all-dependencies:
        patterns:
          - "*"
    open-pull-requests-limit: 100

Updated dependency

requests: 2.30.0 -> 2.34.2

What you expected to see, versus what you actually saw

Expected behavior

Because requests is explicitly declared in both [packages] and [dev-packages], Dependabot should update both corresponding entries in Pipfile.lock:

default.requests = 2.34.2
develop.requests = 2.34.2

Actual behavior

Dependabot updates only the default section:

default.requests = 2.34.2
develop.requests = 2.30.0

The generated PR therefore leaves the development dependency on the old version even though Dependabot reports that requests was updated from 2.30.0 to 2.34.2.

This can also leave a vulnerable version in the develop lockfile section after the Dependabot update has been merged.

Native package manager behavior

Pipenv updates requests in both lockfile sections when the package exists in both [packages] and [dev-packages].

Images of the diff or a link to the PR, issue, or logs

aoyako/dependabot-test#1

Smallest manifest that reproduces the issue

https://github.com/aoyako/dependabot-test