Support updating uv.lock

Is there an existing issue for this?

I have searched the existing issues

Feature description

Now that uv has a lockfile, it would be nice if dependabot supported making updates to pyproject.toml and/or uv.lock using uv.

disable dependabot for pip and enable for github actions

Hell ye 🙌

We're stuck with Dependabot due to corporate reasons and we'd love Dependabot support for uv.lock files as soon as possible.

This has also blocked us, so +1 for prioritising this.

As a stopgap in the meantime, I've hacked together a small GitHub Actions workflow which provides fairly similar functionality to unblock our project whilst we wait. A small demo is available here https://github.com/EdmundGoodman/update-bot if it is helpful to anyone else.

It slightly differs from dependabot in that it makes a PR on a cron schedule if any dependency can be updated rather than whenever a security vulnerability is found, but is good enough for us for now. It differs from other workflows I've seen in this thread, as it PRs rather than just directly committing to main which could break things.

Hi everyone, according to Astral, uv is used to download over 200M packages from pypi everyday.

I verified this info via BigQuery and it is true as yesterday there were 219M downloads from pypi out of 1950M downloads. A total of 11% of all requests made.

Another tool that dependabot supports is poetry and it only comprises <4% of all requests on the same date.

Please see that uv is a extremely relevant project that would be incredibly appreciated if dependabot supports. I don't know if there is any maintainer reading this, but please check the stats.

Query:

SELECT
    COUNT(IF(details.installer.name = 'uv', 1, NULL)) AS uv_downloads,
    COUNT(*) AS total_downloads,
    SAFE_DIVIDE(
        COUNT(IF(details.installer.name = 'uv', 1, NULL)),
        COUNT(*)
    ) * 100 AS percentage
FROM
  `bigquery-public-data.pypi.file_downloads` WHERE TIMESTAMP_TRUNC(timestamp, DAY) = TIMESTAMP("2024-11-06")

As this is taking a while, I have created a github action as a temporary workaround which mimics pip-complile for dependabot.
The push.yml workflow is calling uv-sync.sh to generate a requirements.txt with pip-compile comment for dependabot to pick up

If the previous commit author is dependabot it will add the new updated requirements.txt as constraint to pyproject.toml and run uv lock to update the lockfile.

It exports uv.lock to requirements.txt and adds the pip-compile comment. (also if you forgot to do it yourself)
Finally new uv.lock and requirements.txt are pushed as extra commit.

there is a demo https://github.com/win845/uv-light which has couple of outdated major and minor dependencies, causing dependabot to make pull requests.

NOTE: the extra commit in a github action will not retrigger the workflow again by convention

Remove --locked flag because dependabot doesn't support uv.lock (depe…

@inoa-jboliveira

Can someone from the Dependabot team comment on if this is on their backlog and with what priority? I agree with @inoa-jboliveira that uv is picking up a lot of steam and not having Dependabot support is hindering its adoption in a couple projects I work on 😢.

We switched to another tool for dependency management so that we could start using uv 🤷‍♂️ Just one datapoint of the effects of slow adoption here, but there are alternatives out there.

@samuelhwilliams

@samuelhwilliams What is the alternative with uv support you are using?

@bosd

@bosd Renovate's pep621 manager supports updating uv.lock https://docs.renovatebot.com/modules/manager/pep621/

^ yep, that

But it doesn't create changes to the corresponding uv.lock file.

It's a known missing feature / bug.

renovate's approach is to simply call UV under the hood. Seems a pretty sane solution.

Any reason why dependabot has elected to reimplement this feature (and spend years in development hell with no resolution) instead?

After 10 years of waiting and considerations from GitHub team, I decided to make solution that actually works.

What you need to do, is to create a GitHub Action that will run uv lock and commits your change to the repo. Below is my version, feel free to use it and enjoy your life for the next 10+ years, while preparing their own solution.

name: Code checks

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  PYTHON_VERSION: 3.13

jobs:
  update-lock:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'dependabot/')

    permissions:
      contents: write
      pull-requests: write

    steps:
    - uses: actions/checkout@v3
      with:
        ref: ${{ github.head_ref }}
        token: ${{ secrets.GITHUB_TOKEN }}

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}

    - name: Install uv
      run: pip install uv

    - name: Update lock file
      run: uv lock

    - name: Check for changes and commit
      run: |
        if git diff --quiet uv.lock; then
          echo "No changes to uv.lock"
        else
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add uv.lock
          git commit -m "Update uv.lock"
          git push
        fi

  python-checks:
    runs-on: ubuntu-latest
    needs: update-lock
    if: always() && (needs.update-lock.result == 'success' || needs.update-lock.result == 'skipped')

    steps:
    - uses: actions/checkout@v3
      with:
        ref: ${{ github.head_ref }}
        fetch-depth: 0

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}

    - name: Install uv
      run: pip install uv

    - name: Check lock file
      run: uv lock --check

    - name: Install dependencies
      run: uv sync

    - name: Run Ruff
      run: uv run ruff check

    - name: Run mypy
      run: uv run mypy .

    - name: Run pytest
      run: uv run pytest

Notice that:

fetch-depth: 0 is mandatory - it re-fetches latest changes after we made a commit in the first step (otherwise it won't see your changes in the uv.lock file).
permissions section in the first step is mandatory - without it you can't commit code from inside the CI workflow.

Enjoy the solution? 👍🏻 / ❤️ / 👎🏻

@1st

@1st If the only problem were the missing update to the lock file, I'd +1 the solution, but unfortunately that is not the case; though I agree it could help with broken security fix PRs. (I created a pre-commit hook to check to pyproject.toml - uv.lock sync just two days ago, I would like to plug that as a lighter version of that check https://github.com/ulgens/uv-lock-check )

Meanwhile, https://docs.renovatebot.com/modules/manager/pep621/ is working without any issues.

@1st

@1st @ulgens @danieleades There's an issue where security alerts for uv projects are not working correctly. Specifically, the uv.lock file is not being updated when security alerts are triggered.

The root cause is that uv piggybacks off pip for security advisories, but we can't distinguish between uv and pip projects in our security advisory system. We're evaluating whether we can properly support this, but if we can't find a viable solution, we may need to roll back uv security update support for now until we can fully support it. Note that uv version updates will continue to work as expected.

For more information about the difference between security updates and version updates, see our documentation:

For updates on this issue, follow: #13426

Specifically, the uv.lock file is not being updated when security alerts are triggered.

uv.lock files are not being updated regardless.

it's ok, i'm in the process of migrating my repos to Renovate

@robaiken

@robaiken Thanks for the update, but this was just another update that doesn't actually make sense. The uv.lock issue with security warnings is known for 6+ months, how much more damage should be done before GitHub decides it's not working?

Also, now that an employee acknowledges that uv.lock files are not getting updated, would you mind changing the resolution on this issue so it won't continue to misinform?

it's ok, i'm in the process of migrating my repos to Renovate

I migrated long ago, there is 0 benefit in staying with Dependabot.

Same, migrated away, staying subscribed here for comedy content.

This should now be fixed! Dependabot now supports updating uv.lock files for both version updates and security updates.

Sorry for the wait on getting this resolved. Thanks for your patience. Please let me know if you encounter any issues.

@gegoune

I bet you're not laughing now, @gegoune 🤣

I bet you're not laughing now, @gegoune 🤣

Wrong. I am, while using multitude ecosystems that dependabot still doesn't support. Good try though.

I bet you're not laughing now, @gegoune 🤣

Wrong. I am, while using multitude ecosystems that dependabot still doesn't support. Good try though.

Don't worry dependabot support for uv will be broken again any minute

This should now be fixed! Dependabot now supports updating uv.lock files for both version updates and security updates.

Sorry for the wait on getting this resolved. Thanks for your patience. Please let me know if you encounter any issues.

But why so early? I planned the fix arrive around 2030 - this number looks good.

But without jokes - hope it works. And after I've made my own solution for it recently (I had to do it 6 months ago). Well done 👍

Does this work with uv workspaces living in subdirs single uv.lock in repo root? I don't see lock file is being updated for such case.

@pp-eyushin

@pp-eyushin Could you open a separate issue for this with details of the PR, the failing job, and an example repo if you have one?

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

Support updating `uv.lock` #10478

Is there an existing issue for this?

Feature description

139 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Sunbelt Computer Software

PL/B Language Development and Support

Support updating uv.lock #10478

Description

Is there an existing issue for this?

Feature description

Activity

dvf commented on Sep 19, 2024

danieltalsky commented on Oct 23, 2024

EdmundGoodman commented on Oct 24, 2024

inoa-jboliveira commented on Nov 7, 2024

win845 commented on Nov 19, 2024

sebastian-correa commented on Dec 15, 2024

samuelhwilliams commented on Dec 16, 2024

bosd commented on Dec 16, 2024

chris48s commented on Dec 16, 2024

samuelhwilliams commented on Dec 16, 2024

139 remaining items

ulgens commented on Dec 15, 2025

danieleades commented on Dec 15, 2025

1st commented on Dec 27, 2025

ulgens commented on Dec 27, 2025

robaiken commented on Jan 6, 2026

danieleades commented on Jan 6, 2026

ulgens commented on Jan 6, 2026

gegoune commented on Jan 6, 2026

robaiken commented on Jan 14, 2026

dabeeeenster commented on Jan 14, 2026

gegoune commented on Jan 14, 2026

CramBL commented on Jan 14, 2026

1st commented on Jan 14, 2026

pp-eyushin commented on May 5, 2026

robaiken commented on May 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Support updating `uv.lock` #10478