Update the uv ecosystem to handle uv.lock files #11795
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR introduces support for uv.lock file handling within the uv ecosystem. Key changes include:
- New resolver and updater classes (LockFileResolver and LockFileUpdater) to process uv.lock files.
- Updates to file fetcher and parser to recognize and extract dependency details from uv.lock.
- Enhancements to the pyproject preparer and update checker to integrate uv.lock updates.
Reviewed Changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| uv/spec/dependabot/uv/update_checker/lock_file_resolver_spec.rb | Tests for the new lockfile resolver. |
| uv/lib/dependabot/uv/file_updater/lock_file_updater.rb | Implements update logic for uv.lock files. |
| uv/lib/dependabot/uv/update_checker/lock_file_resolver.rb | Adds a new lock file resolver to check for updatable versions. |
| uv/spec/dependabot/uv/file_parser_spec.rb | Includes tests parsing dependencies from uv.lock files. |
| uv/spec/dependabot/uv/file_fetcher_spec.rb | Updates file fetcher to handle uv.lock files alongside pyproject.toml. |
| uv/lib/dependabot/uv/file_parser.rb | Extends dependency extraction to include uv.lock files. |
| uv/spec/dependabot/uv/file_updater/pyproject_preparer_spec.rb | Updates tests for pyproject preparer changes with uv.lock integration. |
| uv/lib/dependabot/uv/update_checker.rb | Integrates the lock file resolver into the update checker flow. |
| uv/lib/dependabot/uv/file_updater/pyproject_preparer.rb | Adjusts version pinning and authentication environment variable setup. |
| uv/lib/dependabot/uv/file_updater.rb | Modifies the file updater to include updates for uv.lock files. |
Comments suppressed due to low confidence (1)
uv/lib/dependabot/uv/file_fetcher.rb:27
- Including 'uv.lock' in the REQUIREMENT_FILE_PATTERNS may lead to duplicate fetching, as uv.lock files are handled separately. Consider removing 'uv.lock' from these patterns to avoid potential conflicts.
"uv.lock"
Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more
markhallen
force-pushed
the
markhallen/add-support-for-uv-lock-file
branch
from
f108243 to
af4de14
Compare
robaiken
approved these changes
Mar 12, 2025
5 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
This pull request introduces the ability to handle
uv.lockfiles in theuvecosystem.Closes https://github.com/github/dependabot-updates/issues/8726
Anything you want to highlight for special attention from reviewers?
This is adding additional
uv.lockfile handling to theuvecosystem in addition to the existing support forrequirements.inandrequirements.txt.A
pyproject.tomlfile is required in order to update auv.lockfile as per theuvfunctionality.How will you know you've accomplished your goal?
We tested the dry run with
bin/dry-run.rb uv dsp-testing/dependabot-uv.Dry run output
Checklist