Dependabot security update can't connect to private registry magento repository

[Flowster]

Select Topic Area

Bug

Body

I set up a test Github repo to reproduce this issue: test_repo_magento

I've configured dependabot to connect to a magento registry repo.magento.com.
It's working well for Dependabot version updates:

  proxy | 2024/02/23 15:28:27 [019] GET https://repo.magento.com:443/packages.json
  proxy | 2024/02/23 15:28:27 [019] * authenticating composer registry request (host: repo.magento.com)
  proxy | 2024/02/23 15:28:27 [019] 200 https://repo.magento.com:443/packages.json
  proxy | 2024/02/23 15:28:27 [021] GET https://repo.magento.com:443/p/provider-ce%249c439e833a6665c543a756a658864ff6f7542b7008c4d8ad0e1e87efa3e2d486.json
  proxy | 2024/02/23 15:28:27 [021] * authenticating composer registry request (host: repo.magento.com)
  proxy | 2024/02/23 15:28:27 [021] 200 https://repo.magento.com:443/p/provider-ce%249c439e833a6665c543a756a658864ff6f7542b7008c4d8ad0e1e87efa3e2d486.json
  proxy | 2024/02/23 15:28:27 [023] GET https://repo.magento.com:443/p/provider-marketplace-extensions%24310acd74de9f3b2da988cd7271eef6ab4b16955d95f8a5def9051b7df7120b7d.json
  proxy | 2024/02/23 15:28:27 [023] * authenticating composer registry request (host: repo.magento.com)
  proxy | 2024/02/23 15:28:27 [023] 200 https://repo.magento.com:443/p/provider-marketplace-extensions%24310acd74de9f3b2da988cd7271eef6ab4b16955d95f8a5def9051b7df7120b7d.json

But it's not working for Dependabot security updates:

  proxy | 2024/02/23 15:16:25 [019] GET https://repo.magento.com:443/packages.json
  proxy | 2024/02/23 15:16:25 [019] 401 https://repo.magento.com:443/packages.json
  proxy | 2024/02/23 15:16:25 [019] Remote response: {"warning":"You haven\u0027t provided your Magento authentication keys. For instructions, visit https:\/\/devdocs.magento.com\/guides\/v2.3\/install-gde\/prereq\/connect-auth.html"}
updater | 2024/02/23 15:16:25 INFO <job_791401139> Handled error whilst updating phenx/php-svg-lib: private_source_authentication_failure {:source=>"repo.magento.com"}

Here is my .github/dependabot.yml file:

version: 2
registries:
  adobe:
    type: composer-repository
    url: repo.magento.com
    username: 50f33eb43f63c9de3f4dd965ec4c5768
    password: ${{secrets.DEPENDABOT_COMPOSER_PASSWORD}}
updates:
  - package-ecosystem: "composer" # See documentation for possible values
    directory: '/'
    registries:
      - adobe
    schedule:
      interval: "weekly"
    target-branch: "main"
    # Disabe version updates
    open-pull-requests-limit: 1

Here is the test DEPENDABOT_COMPOSER_PASSWORD secret: 990324fae277546f8af8f091f28665c6

Thanks for your help.

[Flowster]

Seems I found the issue.
The target-branch option seems to prevent security updates from using my registries as defined in this documentation.

When you use this option, the settings for this package manager will no longer affect any pull requests raised for security updates.

This doesn't makes any sense to me. Why such a limitation on the branch functionality?