I’m trying to use GitHub Dependabot with a private PyPI feed hosted in Azure Artifacts and am running into a download failure.
Dependabot successfully authenticates to the Azure Artifacts PyPI feed. t can resolve dependencies and identify available package versions.
However, when Dependabot attempts to download a package, Azure Artifacts redirects the request to Azure Blob Storage (which seems to be normal behaviour for package downloads). At that point, the download fails. I see warnings like:
WARN*** Cannot write TLS response body from mitm'd client*** write tcp 172.19.0.2***1080->172.19.0.3***56126*** write*** connection reset by peer
This suggests that authentication to the blob storage endpoint is failing after the redirect.
Additional context:
It works fine with
pip installlocally using the same feed.The problem only occurs when Dependabot downloads the package.
Authentication succeeds on the Azure Artifacts endpoint but appears to fail after the redirect to Blob Storage.
It feels like either:
Dependabot does not forward credentials correctly across the redirect; or
Azure Artifacts’ blob downloads are incompatible with Dependabot’s authentication model.
Is it supported to use Dependabot with a private PyPI feed in Azure Artifacts If so, is there any special configuration required to allow Dependabot to authenticate correctly when Azure Artifacts redirects downloads to Blob Storage?
My dependabot.yml is:
version: 2
registries:
pypi:
type: python-index
url: https://pypi.org/simple/
soltec-pypi:
type: python-index
url: https://soltec-systems.pkgs.visualstudio.com/c174dda0-568f-4a49-958c-37218298404f/_packaging/85c2d40a-0147-40e9-b33d-a08c893f9ba3/pypi/simple/
token:
updates:
- package-ecosystem: pip
directory: /
schedule:
interval: daily
insecure-external-code-execution: allow
registries:
- pypi
- soltec-pypi
open-pull-requests-limit: 1
The original url to our private PyPi server in the dependabot.yml was "https://soltec-systems.pkgs.visualstudio.com/soltec-pypi/_packaging/soltec-pypi/pypi/simple/", but using the url in this form, dependabot fails authentication to the private PyPi server.
Following the advice in this thread - "https://github.com/dependabot/dependabot-core/issues/4780", I replaced the "project_name" and "feed_name" in the url with their respective GUID's (obtained from the logs). With this, authentication to the PyPi server was successful. Note the project name and feed name" are the same.
A section of the dependabot logs is where the connection is reset is shown below:
updater | 2026/01/15 09***06***06 INFO Started process PID*** 2657 with command*** {} pyenv exec poetry update solar-data-feed-api --lock --no-interaction {}
proxy | 2026/01/15 09***06***08 [065] GET https***//soltec-systems.pkgs.visualstudio.com***443/soltec-pypi/_packaging/soltec-pypi/pypi/simple/solar-data-feed-api/
proxy | 2026/01/15 09***06***08 [065] * authenticating python index request (host*** soltec-systems.pkgs.visualstudio.com)
proxy | 2026/01/15 09***06***08 [065] 200 https***//soltec-systems.pkgs.visualstudio.com***443/soltec-pypi/_packaging/soltec-pypi/pypi/simple/solar-data-feed-api/
proxy | 2026/01/15 09***06***08 [067] GET https***//soltec-systems.pkgs.visualstudio.com***443/c174dda0-568f-4a49-958c-37218298404f/_packaging/85c2d40a-0147-40e9-b33d-a08c893f9ba3/pypi/download/solar-data-feed-api/1.3.82/solar_data_feed_api-1.3.82-py3-none-any.whl
2026/01/15 09***06***08 [067] * authenticating python index request (host*** soltec-systems.pkgs.visualstudio.com)
proxy | 2026/01/15 09***06***09 [067] 303 https***//soltec-systems.pkgs.visualstudio.com***443/c174dda0-568f-4a49-958c-37218298404f/_packaging/85c2d40a-0147-40e9-b33d-a08c893f9ba3/pypi/download/solar-data-feed-api/1.3.82/solar_data_feed_api-1.3.82-py3-none-any.whl
proxy | 2026/01/15 09***06***09 [069] GET https***//m8vvsblobprodsu6weus76.blob.core.windows.net***443/b-565b4db73c4c4837ac1e4510c96fb276/6E599F115A2435BCB2C5FA0065EE5D0149AEC7A6654ADC4BD749F4514DE2C21800.blob?sv=2019-07-07&sr=b&sig=&skt=2026-01-15T07***40***51Z&ske=2026-01-17T08***40***51Z&sks=b&skv=2019-07-07&se=2026-01-16T09***06***09Z&sp=r&rscl=x-e2eid-185d553e-eb184737-8a38f3ee-caf8da3b-session-185d553e-eb184737-8a38f3ee-caf8da3b&rscd=attachment%3B%20filename%3D%22solar_data_feed_api-1.3.82-py3-none-any.whl%22
proxy | 2026/01/15 09***06***10 [069] 200 https***//m8vvsblobprodsu6weus76.blob.core.windows.net***443/b-565b4db73c4c4837ac1e4510c96fb276/6E599F115A2435BCB2C5FA0065EE5D0149AEC7A6654ADC4BD749F4514DE2C21800.blob?sv=2019-07-07&sr=b&sig=&skt=2026-01-15T07***40***51Z&ske=2026-01-17T08***40***51Z&sks=b&skv=2019-07-07&se=2026-01-16T09***06***09Z&sp=r&rscl=x-e2eid-185d553e-eb184737-8a38f3ee-caf8da3b-session-185d553e-eb184737-8a38f3ee-caf8da3b&rscd=attachment%3B%20filename%3D%22solar_data_feed_api-1.3.82-py3-none-any.whl%22
proxy | 2026/01/15 09***06***10 [071] GET https***//soltec-systems.pkgs.visualstudio.com***443/c174dda0-568f-4a49-958c-37218298404f/_packaging/85c2d40a-0147-40e9-b33d-a08c893f9ba3/pypi/download/solar-data-feed-api/1.3.82/solar_data_feed_api-1.3.82-py3-none-any.whl
proxy | 2026/01/15 09***06***10 [071] * authenticating python index request (host*** soltec-systems.pkgs.visualstudio.com)
proxy | 2026/01/15 09***06***10 [069] WARN*** Cannot write TLS response body from mitm'd client*** write tcp 172.19.0.2***1080->172.19.0.3***55296*** write*** connection reset by peer
proxy | 2026/01/15 09***06***11 [071] 303 https***//soltec-systems.pkgs.visualstudio.com***443/c174dda0-568f-4a49-958c-37218298404f/_packaging/85c2d40a-0147-40e9-b33d-a08c893f9ba3/pypi/download/solar-data-feed-api/1.3.82/solar_data_feed_api-1.3.82-py3-none-any.whl
proxy | 2026/01/15 09***06***11 [073] GET https***//m8vvsblobprodsu6weus76.blob.core.windows.net***443/b-565b4db73c4c4837ac1e4510c96fb276/6E599F115A2435BCB2C5FA0065EE5D0149AEC7A6654ADC4BD749F4514DE2C21800.blob?sv=2019-07-07&sr=b&sig=&skt=2026-01-15T06***50***56Z&ske=2026-01-17T07***50***56Z&sks=b&skv=2019-07-07&se=2026-01-16T09***06***10Z&sp=r&rscl=x-e2eid-42b4a12d-a3cd4074-9fc1e340-b5cec361-session-42b4a12d-a3cd4074-9fc1e340-b5cec361&rscd=attachment%3B%20filename%3D%22solar_data_feed_api-1.3.82-py3-none-any.whl%22
proxy | 2026/01/15 09***06***11 [073] 200 https***//m8vvsblobprodsu6weus76.blob.core.windows.net***443/b-565b4db73c4c4837ac1e4510c96fb276/6E599F115A2435BCB2C5FA0065EE5D0149AEC7A6654ADC4BD749F4514DE2C21800.blob?sv=2019-07-07&sr=b&sig=&skt=2026-01-15T06***50***56Z&ske=2026-01-17T07***50***56Z&sks=b&skv=2019-07-07&se=2026-01-16T09***06***10Z&sp=r&rscl=x-e2eid-42b4a12d-a3cd4074-9fc1e340-b5cec361-session-42b4a12d-a3cd4074-9fc1e340-b5cec361&rscd=attachment%3B%20filename%3D%22solar_data_feed_api-1.3.82-py3-none-any.whl%22
Dependabot is running on a GitHub-hosted runner.