Skip to content

PEP 621

Categories: python

Renovate supports updating PEP 621 dependencies.

File Matching

By default, Renovate will check any files matching the following regular expression: /(^|/)pyproject\.toml$/.

For details on how to extend a manager's managerFilePatterns value, please follow this link.

Supported datasources

This manager supports extracting the following datasources: pypi.

Dependency types

This manager extracts the following depType values:

depType Description
requires-python The requires-python constraint from [project]
project.dependencies Listed under [project.dependencies]
project.optional-dependencies Listed under [project.optional-dependencies]
dependency-groups Listed under [dependency-groups] (PEP 735)
build-system.requires Listed under [build-system.requires]
tool.pdm.dev-dependencies Listed under [tool.pdm.dev-dependencies]
tool.uv.dev-dependencies Listed under [tool.uv.dev-dependencies]
tool.uv.sources Listed under [tool.uv.sources]

Hatch environments produce dynamic depType values in the form tool.hatch.envs.<env-name>.

Default config

{
  "managerFilePatterns": [
    "/(^|/)pyproject\\.toml$/"
  ]
}

Lock File Maintenance

This manager supports lockFileMaintenance for the following file(s):

  • pdm.lock
  • uv.lock

Delegated to the underlying package manager CLI - pdm or uv - depending on which lockfile format the project uses.

Additional Information

This manager supports updating dependencies inside pyproject.toml files.

In addition to standard dependencies, these toolsets are also supported:

  • pdm (including pdm.lock files)
  • uv (including uv.lock files and uv workspaces)
  • hatch
  • pixi (including pixi.lock files)

Trust model for pixi lock file updates

Running pixi lock can execute arbitrary code from conda package hooks, so Renovate treats pixi.lock refreshes as an unsafe execution. See pixi's security documentation for details.

Self-hosted administrators must explicitly allow this path by including pixi in the global allowedUnsafeExecutions setting. When pixi is not allowed, dependencies in pyproject.toml are still updated, but pixi.lock is left unchanged.

Private Modules Authentication

Before running the pdm or uv commands to update the pdm.lock or uv.lock respectively, Renovate exports git insteadOf directives in environment variables.

Renovate uses this logic before it updates any "artifacts":

The token from the hostRules entry matching hostType=github and matchHost=api.github.com is added as the default authentication for github.com. For those running against github.com, this token will be the default platform token.

Next, all hostRules with both a token or username/password and matchHost will be fetched, except for any github.com one from above.

Rules from this list are converted to environment variable directives if they match any of these characteristics:

  • No hostType is defined, or
  • hostType is pep621, or
  • hostType is a platform (github, gitlab, azure, etc.)