Transitive dependencies in `uv.lock` not updated by dependabot

[alexdewar]

Background

While the direct dependencies are updated by dependabot, transitive (indirect) dependencies are not, which seems to be a known problem: dependabot/dependabot-core#14073

This is going to become a more pressing problem as we move to using uv for most new Python projects (#507).

There are a few potential problems with not updating transitive deps:

1. Not getting fixes for security vulnerabilities (though I believe you can configure dependabot to open PRs for these)
2. Not getting fixes for bugs/performance issues
3. Binary wheels for old versions of packages being removed (even fairly recent versions of packages seem not to have binary wheels on PyPI)

The last one was an issue with FROG (ImperialCollegeLondon/FROG#942). I was trying to build the package on a researcher's machine, but seemingly one of the dependencies required a Rust toolchain, so the build just failed 😞.

Potential solutions

1. We could write a CI workflow which calls uv lock --upgrade at regular intervals to supplement what dependabot is doing
2. We could move to Renovate, which supports updating transitive dependencies out of the box

The downside of moving to a separate tool is that it would involve another configuration step, which is annoying. Might be worth it though. You can [use it for private repos] too.

Thoughts, everyone? Tagging Christopher Cave-Ayland (@cc-a) as this is vaguely security related 😄

[AdrianDAlessandro]

The reverse of this was the problem with using dependabot for pip-tools projects. It would update transitive dependencies and that could make it incompatible with the direct dependency.

When dependabot updates a single dependancy in uv mode, does it not update that package along with any of its dependancies that also need updating? This is the behaviour I think we should have.

[alexdewar]

I assume it will update any transitive deps that need updating (e.g. a new version of package X only works with numpy>1.2, so that will be updated too), but if there happens to be a new release of numpy and it's not a direct dependency, then it'll just be left on an old version forever.

It won't leave you with a broken lockfile, though.