Dependabot-core: dependabot v2 can't merge to protected branches

[ZebraFlesh]

Using dependabot v2 (AKA GitHub-native Dependabot), I am unable to have dependabot successfully execute a @dependabot merge command against a protected branch. When I issue the merge command in a comment on the PR, I get the standard You're not authorized to push to this branch. Visit https://docs.github.com/articles/about-protected-branches/ for more information. error. Dependabot v1 used a GitHub App which allowed me to add the dependabot-preview user to my branch protection rules. v2 seems to have changed things up by dropping the app, but now there's nothing for me to add to my branch protection rules. (The dependabot-preview user is still able to push to the protected branch, but v2 uses a user called dependabot so it doesn't match.)

[jurre]

Hi @ZebraFlesh, yeah this is a known issue that we're already tracking internally. Will keep you up to date when we have a fix for this, but unfortunately it's not straightforward so it might take a while before a fix for this lands.

[ZebraFlesh]

Thanks for the update. This issue is blocking me from upgrading to v2, so I'll definitely be keeping an eye.

[christoferolaison]

Any updates on this issue?