You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci(Renovate): Upgrade to Renovate 44 and drop uv lock file maintenance - #8912
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.
Changes
We've been running Renovate 43.288.0. Transitive security updates for uv.lock landed in Renovate 44.221.0, so we haven't been getting them.
In this PR, we:
Bump renovatebot/github-action to v46.3.13, which runs renovate:44.
Disable lock file maintenance for uv. Vulnerable lockfile-only dependencies are now remediated directly, from both Dependabot alerts and OSV. Lock file maintenance stays on for npm, which has no equivalent yet.
How did you test this code?
Dry run of Renovate 44.223.1 against this branch (--platform=local --dry-run=lookup):
With the pep621 manager, Renovate logs oauthlib and social-auth-core as "only in a lock file, but a vulnerability alert matches it". It plans renovate/pypi-oauthlib-vulnerability and renovate/pypi-social-auth-core-vulnerability, plus the existing datamodel-code-generator fix, and no lock file maintenance branch.
With the npm manager, the lock file maintenance branch is still planned.
renovatebot/github-action was pinned to v46.1.20, which runs the floating
renovate:43 image (43.288.0). Transitive security updates for uv.lock landed
in Renovate 44.221.0 (renovatebot/renovate#47482), so bump the action to
v46.3.13, which runs renovate:44.
Since security:only-security-updates disables everything, the action never
got updated; re-enable updates for it.
Lock file maintenance is no longer needed for uv, as vulnerable lockfile-only
dependencies are now remediated directly; keep it for npm.
The Renovate workflow now references a different commit of the Renovate GitHub Action. The Renovate configuration disables lock-file maintenance for the pep621 manager and limits the existing lock-file-maintenance rule to the npm manager.
The upgrade supports targeted uv security updates, but removing maintenance leaves compatible fixes unproposed when both alert sources miss a vulnerability. Mergeable with explicit acceptance of this bounded fallback loss.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 1
Review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: a955528e-f8d5-4cf5-88b8-89341cfdc340
Commits
Reviewing files that changed from the base of the PR and between 1dfc2b3 and 4fd417b.
Files selected for processing: 2
.github/workflows/renovate.yml
renovate.json
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 5 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
ci-cd
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Thanks for submitting a PR! Please check the boxes below:
docs/if required so people know about the feature.Changes
We've been running Renovate 43.288.0. Transitive security updates for
uv.locklanded in Renovate 44.221.0, so we haven't been getting them.In this PR, we:
renovatebot/github-actionto v46.3.13, which runsrenovate:44.How did you test this code?
Dry run of Renovate 44.223.1 against this branch (
--platform=local --dry-run=lookup):pep621manager, Renovate logsoauthlibandsocial-auth-coreas "only in a lock file, but a vulnerability alert matches it". It plansrenovate/pypi-oauthlib-vulnerabilityandrenovate/pypi-social-auth-core-vulnerability, plus the existingdatamodel-code-generatorfix, and no lock file maintenance branch.npmmanager, the lock file maintenance branch is still planned.renovate-config-validator --strict renovate.jsonpasses.After merging, trigger the Renovate workflow manually and check that the run log reports version 44.221.0 or later.