Automated Dependency Updates for PEP 621

Categories: python

Renovate supports updating PEP 621 dependencies.

File Matching

By default, Renovate will check any files matching the following regular expression: /(^|/)pyproject\.toml$/.

For details on how to extend a manager's managerFilePatterns value, please follow this link.

Supported datasources

This manager supports extracting the following datasources: pypi.

Dependency types

This manager extracts the following depType values:

depType	Description
requires-python	The requires-python constraint from [project]
project.dependencies	Listed under [project.dependencies]
project.optional-dependencies	Listed under [project.optional-dependencies]
dependency-groups	Listed under [dependency-groups] (PEP 735)
build-system.requires	Listed under [build-system.requires]
tool.pdm.dev-dependencies	Listed under [tool.pdm.dev-dependencies]
tool.uv.dev-dependencies	Listed under [tool.uv.dev-dependencies]
tool.uv.sources	Listed under [tool.uv.sources]

Hatch environments produce dynamic depType values in the form tool.hatch.envs.<env-name>.

Default config

{
  "managerFilePatterns": [
    "/(^|/)pyproject\\.toml$/"
  ]
}

Lock File Maintenance

This manager supports lockFileMaintenance for the following file(s):

• pdm.lock
• uv.lock

Additional Information

This manager supports updating dependencies inside pyproject.toml files.

In addition to standard dependencies, these toolsets are also supported:

• pdm (including pdm.lock files)
• uv (including uv.lock files and uv workspaces)
• hatch

Private Modules Authentication

Before running the pdm or uv commands to update the pdm.lock or uv.lock respectively, Renovate exports git insteadOf directives in environment variables.

Renovate uses this logic before it updates any "artifacts":

The token from the hostRules entry matching hostType=github and matchHost=api.github.com is added as the default authentication for github.com. For those running against github.com, this token will be the default platform token.

Next, all hostRules with both a token or username/password and matchHost will be fetched, except for any github.com one from above.

Rules from this list are converted to environment variable directives if they match any of these characteristics:

• No hostType is defined, or
• hostType is pep621, or
• hostType is a platform (github, gitlab, azure, etc.)