Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

🤖 Integrate Renovatebot for Automated Dependency Updates

Offen
  • Stimmt etwas nicht?
#187 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 12 Tagen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
52/100
Issue-Typ
Feature
Klarheit
Klar beschrieben
Aktivitätsstatus
Veraltet
Tech-Stack
github, python
Bereich
ci-cd, devops

Rechercherichtung

Start with the proposed renovate.json configuration and inspect the requirements/.in and requirements/.txt workflow, including task dependencies:upgrade. Install the Mend Renovate GitHub App, add the configuration, merge the onboarding PR, and verify that generated dependency-update PRs include the expected source and compiled-file changes and pass CI.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

dependencies enhancement

Overview

Explore integrating Renovatebot as our automated dependency management solution. This complements our recent migration to uv while providing automated dependency updates without requiring migration to pyproject.toml immediately.

Why Renovatebot?

Following discussion in #184, Renovatebot emerged as a superior alternative to Dependabot for our workflow:

✅ Advantages over Manual Workflow
  1. Automated security updates: Get notified of vulnerabilities with automated fix PRs
  2. Time savings: No more manual task dependencies:upgrade runs
  3. Granular control: Group related updates (e.g., Django ecosystem), schedule updates (e.g., Mondays only)
  4. Better visibility: Track all dependency updates in one place with proper PR descriptions
✅ Advantages over Dependabot

Based on research and community feedback (see #184):

  • ✅ Native uv support: Handles both uv.lock and pip-compile workflows
  • ✅ Better lock file handling: No issues with marking security fixes as resolved without updating locks
  • ✅ More mature: ~10 years old, actively maintained
  • ✅ Better configuration: Advanced grouping, scheduling, automerge options
  • ✅ Higher API limits: 15,000 requests/hour vs 5,000/hour
✅ Works with Our Current Workflow

Renovatebot supports our current requirements/*.in → requirements/*.txt (pip-compile) workflow:

  • Updates source files (.in)
  • Automatically regenerates compiled files (.txt)
  • Creates PRs with both changes included

Heroku Native uv Support

Heroku now supports uv natively (announcement, docs) as of May 2025.

Requirements for Heroku uv support:

  • pyproject.toml + uv.lock + .python-version
  • Must remove requirements.txt files (other package managers take precedence)

Implication: To use Heroku's native uv support, we'd need to migrate from our current .in/.txt workflow to pyproject.toml + uv.lock.

Renovatebot advantage: Supports BOTH workflows, so we can:

  1. Enable Renovatebot now with our current pip-compile setup
  2. Migrate to pyproject.toml + uv.lock when ready for Heroku's native uv support
  3. Renovatebot will continue working seamlessly after migration

Implementation Cost

Zero cost, minimal setup:

  • ✅ Free: Mend Renovate GitHub App is free for open source projects
  • ✅ No infrastructure: Cloud-hosted, no self-hosting required
  • ✅ 5-minute setup: Install GitHub App + merge onboarding PR
  • ✅ No scripts: Just a renovate.json config file

Proposed Configuration

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "pip-compile": {
    "managerFilePatterns": ["requirements/.*\\.txt$"]
  },
  "pip_requirements": { "enabled": false },
  "packageRules": [
    {
      "groupName": "Django ecosystem",
      "matchPackagePatterns": ["^[Dd]jango", "^[Ww]agtail"],
      "schedule": ["before 9am on monday"]
    },
    {
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "pr"
    }
  ],
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 9am on the first day of the month"]
  }
}

Key features:

  • Groups Django/Wagtail updates together
  • Schedules updates for Monday mornings
  • Auto-merges patch updates (e.g., 6.0.1 → 6.0.2)
  • Monthly lock file refresh for transitive dependencies

Migration Path

Phase 1: Enable Renovatebot (current workflow)
  1. Install Mend Renovate GitHub App
  2. Configure for pip-compile workflow
  3. Merge onboarding PR
  4. Monitor and tune configuration
Phase 2 (Future): Migrate to pyproject.toml + uv.lock

When ready to use Heroku's native uv support:

  1. Migrate to pyproject.toml + uv.lock
  2. Update Renovatebot config to use PEP 621 manager
  3. Remove pip-compile configuration
  4. Benefit from Heroku's faster uv deployments

Comparison with Manual Workflow

Aspect Manual (task dependencies:upgrade) Renovatebot
Frequency When we remember Automated schedule
Security alerts Manual monitoring Automated PRs
Granularity All-or-nothing Per-package or grouped
Test before merge Manual CI runs automatically
Time investment ~30min monthly ~5min to review PRs

Next Steps

  • Community feedback on this proposal
  • Install Mend Renovate GitHub App: https://github.com/apps/renovate
  • Create renovate.json with proposed configuration
  • Merge onboarding PR
  • Monitor first round of dependency update PRs
  • Fine-tune configuration based on experience

References

Vorherrschende Sprache
Python
Sterne
17
Forks
27
Ø Merge
59 Min.
Gemergte PRs (30 T.)
13

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus PythonIreland/website

Alle Issues in PythonIreland/website

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.