chore(renovate): switch to pep621 manager (uv-managed projects)#40
Conversation
This repo manages dependencies with uv (uv.lock present) but renovate.json declared "enabledManagers": ["poetry", "github-actions"]. Renovate's enabledManagers is replace-not-merge, so the poetry manager was attempting to parse pyproject.toml's [project.dependencies] table, which it doesn't understand, and silently produced zero PRs. Changes: enabledManagers poetry -> uv, packageRules matchManagers poetry -> uv, removed top-level poetry block and poetryMassage postUpdateOption.
|
Warning Review limit reached
More reviews will be available in 52 minutes and 11 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR updates Renovate configuration to use pep621 dependency management instead of poetry, migrating post-update strategy to uvUpdatePreciseVersion for uv lock file support. PackageRules are reorganized to match pep621 field targets, GitHub Actions auto-merge scope expands to include pin updates, and enabledManagers switches to pep621 with regex added. CHANGELOG documents these fixes. ChangesRenovate pep621 Migration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
There was a problem hiding this comment.
Pull request overview
This PR updates Renovate configuration to use the uv manager for Python dependency discovery, aligning automation with the repo’s pyproject.toml/uv.lock dependency setup.
Changes:
- Replaces Poetry manager references with
uv. - Removes Poetry-specific Renovate configuration and post-update option.
- Keeps GitHub Actions dependency management enabled.
Comments suppressed due to low confidence (1)
renovate.json:33
- After switching this rule to the
uvmanager,matchDepTypes: ["dependencies"]no longer matches the dep type emitted for PEP 621 runtime dependencies in this repo ([project].dependencies, reported by Renovate's uv extraction asproject.dependencies). As written, the Python dependency grouping/schedule rule will not apply; update the dep type match to the uv dep type used for[project.dependencies].
"uv"
],
"matchDepTypes": [
"dependencies"
],
Renovate 42.92.x has no standalone "uv" manager. The previous commit added "uv" to enabledManagers, which rejects the entire config with "Config validation errors found: ... not supported: uv". The correct manager for uv-managed Python projects is pep621 (reads PEP 621 [project.dependencies] from pyproject.toml). uv.lock regeneration is handled by RENOVATE_BINARY_SOURCE=install in the global Renovate env. See homelab-infra PR #309/#314 (May 2026) where this exact mistake was made and reverted previously.
williaby
changed the title
|
Amended to use |
The pep621 Renovate manager emits depType values:
- project.dependencies
- dependency-groups
- tool.uv.dev-dependencies
Not the values used by other managers ("dependencies", "devDependencies",
"dev"). PackageRules using the wrong depType silently no-op, same class
of silent-failure bug as the "uv" manager trap from this remediation
campaign. CodeRabbit flagged this on PR #190 with an authoritative diff.
See standards manifest TOOL-014 (added 2026-05-24).
|
Added fix(renovate): correct matchDepTypes for pep621 (see TOOL-014). Validator still clean. |
PR Review: chore(renovate): switch to pep621 managerAgents: CLAUDE.md compliance, Bug Scan, Security, PR Description validation Critical (must fix before merge)[Bug] [Bug] [Standards] Important (should fix)[Docs] PR description [Bug] [Security] SonarQube: 0 issues, 0 hotspots (JSON-only change). 🤖 Generated with Claude Code |
- add "regex" to enabledManagers; omitting it silently disabled customManagers (CI version-pin regex tracking produced zero matches) - add project.optional-dependencies packageRule so extras deps are grouped; without it seven extras would each generate a separate PR - add "pin" to github-actions matchUpdateTypes so SHA digest-pin PRs are included in automerge alongside minor/patch - replace no-op postUpdateOptions python block with uvUpdatePreciseVersion so lockFileMaintenance correctly regenerates uv.lock Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
/pr-fix summaryFour issues found during review have been resolved in commit 4bec141: Critical (fixed)Missing "regex" in enabledManagers -- The Missing project.optional-dependencies packageRule -- The Important (fixed)postUpdateOptions was a no-op -- The config had Suggested (fixed)"pin" missing from github-actions matchUpdateTypes -- The automerge rule for GitHub Actions covered Not fixed (human review required)
Pre-existing CI failuresThe security CI jobs are failing on |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 15-20: Several changelog bullets (e.g., the lines starting with
"fix(renovate): switch Renovate manager from poetry to pep621 for uv-managed
project", "fix(renovate): add \"regex\" to enabledManagers; omitting it silently
disabled customManagers and broke CI version-pin regex tracking",
"fix(renovate): add \"pin\" to github-actions matchUpdateTypes so SHA digest-pin
PRs are also auto-merged", and similar long entries) exceed the 120-character
Markdown line length; hard-wrap each long bullet so no line is over 120
characters by breaking after sensible punctuation or clause boundaries and
indenting continuation lines to align with the bullet, ensuring each
"fix(renovate): ..." bullet is wrapped into multiple lines under the same list
item.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: b3669719-6255-456e-8b1b-9d02bc4faba4
📒 Files selected for processing (2)
CHANGELOG.mdrenovate.json
| - fix(renovate): switch Renovate manager from poetry to pep621 for uv-managed project; poetry manager was silently producing zero dependency PRs | ||
| - fix(renovate): correct pep621 matchDepTypes to project.dependencies / dependency-groups / tool.uv.dev-dependencies | ||
| - fix(renovate): add "regex" to enabledManagers; omitting it silently disabled customManagers and broke CI version-pin regex tracking | ||
| - fix(renovate): add project.optional-dependencies packageRule to group extras deps; ungrouped extras would have generated one PR per package | ||
| - fix(renovate): add "pin" to github-actions matchUpdateTypes so SHA digest-pin PRs are also auto-merged | ||
| - fix(renovate): replace no-op postUpdateOptions with uvUpdatePreciseVersion so lockFileMaintenance correctly regenerates uv.lock |
There was a problem hiding this comment.
Wrap long changelog bullets to stay within 120 characters.
Several added bullet lines exceed the Markdown 120-character limit (e.g., Line 15, Line 17, Line 18, Line 20).
Please hard-wrap these entries onto continuation lines.
Suggested formatting
-- fix(renovate): switch Renovate manager from poetry to pep621 for uv-managed project; poetry manager was silently producing zero dependency PRs
+- fix(renovate): switch Renovate manager from poetry to pep621 for uv-managed project;
+ poetry manager was silently producing zero dependency PRsAs per coding guidelines, "**/*.md: Use 120-character line length for Markdown documentation files".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CHANGELOG.md` around lines 15 - 20, Several changelog bullets (e.g., the
lines starting with "fix(renovate): switch Renovate manager from poetry to
pep621 for uv-managed project", "fix(renovate): add \"regex\" to
enabledManagers; omitting it silently disabled customManagers and broke CI
version-pin regex tracking", "fix(renovate): add \"pin\" to github-actions
matchUpdateTypes so SHA digest-pin PRs are also auto-merged", and similar long
entries) exceed the 120-character Markdown line length; hard-wrap each long
bullet so no line is over 120 characters by breaking after sensible punctuation
or clause boundaries and indenting continuation lines to align with the bullet,
ensuring each "fix(renovate): ..." bullet is wrapped into multiple lines under
the same list item.
…2026-139 (torch) (#44) * fix(security): resolve PYSEC-2026-161 (starlette) and suppress PYSEC-2026-139 (torch) Unblocks CI on PRs #39, #40, and #41. Both pip-audit and osv-scanner were flagging the same two CVEs, cascading into Code Quality, OSV Scanner, Security Gate, and CI Gate failures on every open PR. - Bump fastapi>=0.133.0 in [audio] extras and regenerate uv.lock; fastapi 0.136.3 + starlette 1.1.0 resolve PYSEC-2026-161. - Add PYSEC-2026-139 (torch/CVE-2026-4538) to osv-scanner.toml and [tool.pip-audit] ignore-vuln; no upstream fix exists. Torch is an optional [ml] extra absent from the production container. - Document PYSEC-2026-139 in docs/known-vulnerabilities.md per project CVE policy; reassess-by 2026-07-26. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: correct torch CVE suppression justification and compensating controls The PYSEC-2026-139 / CVE-2026-4538 suppression in three files contained two false claims: 1. "torch is never imported by the deployed service" - vad.py:16 has an unconditional top-level `import torch`, refuting the grep verification. 2. "not installed in the production container (which installs only the audio extra)" - the Dockerfile runs `uv sync --frozen --no-dev` with no --extra flags; no optional extras are installed at all. The compensating control (torch absent from production) remains valid. Update all three files to state the accurate mechanism: the Dockerfile installs no optional extras, so neither [ml] (direct) nor [audio] (transitive via silero-vad) entries for torch reach the runtime image. Remove the false grep verification claim from compensating controls. Also corrects: - Package field: adds the silero-vad transitive path in [audio] extra - Patched version row: shortened to fit 120-char Markdown line limit - pyproject.toml fastapi comment: "starlette<1.0.0" -> "starlette 0.x"; "starlette 1.x" -> "starlette>=1.1.0" (1.1.0 is the specific fix version) - osv-scanner.toml: replaces -- double-dash with comma (writing rule PC-011) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(changelog): add PYSEC-2026-161 and CVE-2026-4538 security entries Per CLAUDE.md CVE Citation Policy: any CHANGELOG entry that fixes a security vulnerability must include the CVE ID if one has been assigned. - PYSEC-2026-161 (starlette < 1.1.0): resolved by fastapi>=0.133.0 - CVE-2026-4538 / PYSEC-2026-139 (torch 2.9.1, AV:L HIGH): deferred with reassess-by 2026-07-26; no upstream fix available Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Summary
This repo manages dependencies with uv (`uv.lock` present), but `renovate.json` declared:
```json
"enabledManagers": ["poetry", "github-actions"]
```
Renovate's `enabledManagers` is replace-not-merge, so the global config does not fill in `pep621`. The `poetry` manager tries to parse `pyproject.toml`'s `[tool.poetry.dependencies]` table, but uv projects declare deps under `[project.dependencies]`. Result: Renovate silently parses zero Python deps and produces no PRs.
Changes
Test plan
Summary by CodeRabbit