From 635a76cad321b1fe3593a71dc7533cabbca244aa Mon Sep 17 00:00:00 2001 From: Zanie Blue Date: Fri, 20 Mar 2026 14:01:55 -0500 Subject: [PATCH] Split the dependency-bots page into two separate pages (#18597) --- docs/guides/integration/dependabot.md | 48 ++++++++++++++++ docs/guides/integration/index.md | 2 + .../{dependency-bots.md => renovate.md} | 57 +++---------------- mkdocs.yml | 7 ++- 4 files changed, 62 insertions(+), 52 deletions(-) create mode 100644 docs/guides/integration/dependabot.md rename docs/guides/integration/{dependency-bots.md => renovate.md} (63%) diff --git a/docs/guides/integration/dependabot.md b/docs/guides/integration/dependabot.md new file mode 100644 index 000000000..c1ff1562a --- /dev/null +++ b/docs/guides/integration/dependabot.md @@ -0,0 +1,48 @@ +--- +title: Using uv with Dependabot +description: A guide to using uv with the Dependabot dependency bot. +--- + +# Dependabot + +It is considered best practice to regularly update dependencies, to avoid being exposed to +vulnerabilities, limit incompatibilities between dependencies, and avoid complex upgrades when +upgrading from a too old version. + +Dependabot has announced support for uv, but there are some use cases that are not yet working. See +[astral-sh/uv#2512](https://github.com/astral-sh/uv/issues/2512) for updates. + +Dependabot supports updating `uv.lock` files. To enable it, add the uv `package-ecosystem` to your +`updates` list in the `dependabot.yml`: + +```yaml title="dependabot.yml" +version: 2 + +updates: + - package-ecosystem: "uv" + directory: "/" + schedule: + interval: "weekly" +``` + +## Dependency cooldown + +If you use [`exclude-newer`](../../reference/settings.md#exclude-newer) option, it is recommended to +also set the equivalent +[`cooldown`](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-) +option in Dependabot, to avoid ending up with pull requests where uv would not be able to lock the +dependencies. + +For instance, if you've set `exclude-newer` to `1 week`, you can set: + +```yaml title="dependabot.yml" +version: 2 + +updates: + - package-ecosystem: "uv" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 +``` diff --git a/docs/guides/integration/index.md b/docs/guides/integration/index.md index d46e2c174..3b2c33644 100644 --- a/docs/guides/integration/index.md +++ b/docs/guides/integration/index.md @@ -11,6 +11,8 @@ Learn how to integrate uv with other software: - [Using with alternative package indexes](./alternative-indexes.md) - [Installing PyTorch](./pytorch.md) - [Building a FastAPI application](./fastapi.md) +- [Using with Renovate](./renovate.md) +- [Using with Dependabot](./dependabot.md) - [Using with AWS Lambda](./aws-lambda.md) - [Using with Coiled](./coiled.md) diff --git a/docs/guides/integration/dependency-bots.md b/docs/guides/integration/renovate.md similarity index 63% rename from docs/guides/integration/dependency-bots.md rename to docs/guides/integration/renovate.md index 20ea5d932..e52b52820 100644 --- a/docs/guides/integration/dependency-bots.md +++ b/docs/guides/integration/renovate.md @@ -1,20 +1,17 @@ --- -title: Using uv with dependency bots -description: A guide to using uv with dependency bots like Renovate and Dependabot. +title: Using uv with Renovate +description: A guide to using uv with the Renovate dependency bot. --- -# Dependency bots +# Renovate It is considered best practice to regularly update dependencies, to avoid being exposed to vulnerabilities, limit incompatibilities between dependencies, and avoid complex upgrades when -upgrading from a too old version. A variety of tools can help staying up-to-date by creating -automated pull requests. Several of them support uv, or have work underway to support it. - -## Renovate +upgrading from a too old version. uv is supported by [Renovate](https://github.com/renovatebot/renovate). -### `uv.lock` output +## `uv.lock` output Renovate uses the presence of a `uv.lock` file to determine that uv is used for managing dependencies, and will suggest upgrades to @@ -37,7 +34,7 @@ option: } ``` -### Inline script metadata +## Inline script metadata Renovate supports updating dependencies defined using [inline script metadata](../scripts.md/#declaring-script-dependencies). @@ -65,7 +62,7 @@ like so: script (https://github.com/renovatebot/renovate/issues/33591), so if you rely on this feature for a script, the lock file will need to be manually updated. -### Dependency cooldown +## Dependency cooldown If you use [`exclude-newer`](../../reference/settings.md#exclude-newer) option, it is recommended to also set the equivalent @@ -91,43 +88,3 @@ For instance, if you've set `exclude-newer` to `1 week`, you can set: minimumReleaseAge: "1 week", } ``` - -## Dependabot - -Dependabot has announced support for uv, but there are some use cases that are not yet working. See -[astral-sh/uv#2512](https://github.com/astral-sh/uv/issues/2512) for updates. - -Dependabot supports updating `uv.lock` files. To enable it, add the uv `package-ecosystem` to your -`updates` list in the `dependabot.yml`: - -```yaml title="dependabot.yml" -version: 2 - -updates: - - package-ecosystem: "uv" - directory: "/" - schedule: - interval: "weekly" -``` - -### Dependency cooldown - -If you use [`exclude-newer`](../../reference/settings.md#exclude-newer) option, it is recommended to -also set the equivalent -[`cooldown`](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-) -option in Dependabot, to avoid ending up with pull requests where uv would not be able to lock the -dependencies. - -For instance, if you've set `exclude-newer` to `1 week`, you can set: - -```yaml title="dependabot.yml" -version: 2 - -updates: - - package-ecosystem: "uv" - directory: "/" - schedule: - interval: "weekly" - cooldown: - default-days: 7 -``` diff --git a/mkdocs.yml b/mkdocs.yml index 3c0224b54..7213606ad 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -83,6 +83,7 @@ plugins: "configuration/indexes.md": "concepts/indexes.md" "configuration/environment.md": "reference/environment.md" "guides/export.md": "concepts/projects/export.md" + "guides/integration/dependency-bots.md": "guides/integration/renovate.md" - llmstxt: markdown_description: | You can use uv to install Python dependencies, run scripts, manage virtual environments, @@ -117,7 +118,8 @@ plugins: - guides/integration/pytorch.md - guides/integration/fastapi.md - guides/integration/alternative-indexes.md - - guides/integration/dependency-bots.md + - guides/integration/renovate.md + - guides/integration/dependabot.md - guides/integration/aws-lambda.md - guides/integration/coiled.md Projects: @@ -198,7 +200,8 @@ nav: - PyTorch: guides/integration/pytorch.md - FastAPI: guides/integration/fastapi.md - Alternative indexes: guides/integration/alternative-indexes.md - - Dependency bots: guides/integration/dependency-bots.md + - Renovate: guides/integration/renovate.md + - Dependabot: guides/integration/dependabot.md - AWS Lambda: guides/integration/aws-lambda.md - Coiled: guides/integration/coiled.md - Concepts: