Python: Support inline script metadata (PEP 723) · Issue #11946 · dependabot/dependabot-core · GitHub
Skip to content

Python: Support inline script metadata (PEP 723) #11946

Open
Open
Python: Support inline script metadata (PEP 723)#11946
Labels
L: pythonL: python:uvT: feature-requestRequests for new features

Description

@woodruffw
woodruffw
opened on Apr 1, 2025

Is there an existing issue for this?

  • I have searched the existing issues

Feature description

Hello Dependabot maintainers! Thank you for creating Dependabot, it's a fantastic tool.

This is similar to #10478, but not the same: #10478 concerns uv and uv.lock specifically, while this is about inline script metadata, which is not specific to uv and involves individual Python source files, not uv.lock files.

TL;DR: Inline script metadata is a Python packaging standard that specifies an inline metadata format for Python scripts, which appears as a contiguous preamble comment at the head of a Python file (after the shebang). For example:

# /// script
# requires-python = ">=3.13"
# dependencies = [
#     "pre-commit==4.2.0",
#     "pytz==2025.2",
#     "requests==2.32.3",
#     "requests-cache==1.2.1",
# ]
# ///

This preamble comment is formatted as TOML and contains much of the same information as a pyproject.toml would, which Dependabot already supports. In particular, it supports a dependencies key that behaves the same as in pyproject.toml, and as exemplified above.

I would like Dependabot to support this preamble (detect /// script and /// as delimiters) for version updating purposes! Doing so should be able to reuse most of the existing pyproject.toml machinery; the main change is probably a small amount of pre- and post-processing to mold the dependency changes back into the comment preamble format.

Supporting this would be a huge boon for the Python ecosystem, which has increasingly come to rely on inline script metadata as a replacement for "sidecar" requirements.txt files.

Additional resources:

Activity

  1. woodruffw
    added
    T: feature-requestRequests for new features
    on Apr 1, 2025
  2. github-project-automation
    added this to Dependaboton Apr 1, 2025
  3. github-actions
    added
    L: python
    L: python:uv
    on Apr 1, 2025
  4. woodruffw
    added 2 commits that reference this issue on Apr 1, 2025

    add xref to dependabot/dependabot-core#11946

    495bf2f

    move to PEP 723 metadata (#14)

    9594d7e

  5. zanieb commented on Apr 1, 2025

    @zanieb
    zanieb
    on Apr 1, 2025

    As a minor note, uv does support lockfiles for PEP 723 scripts (which would also need to be updated when using uv).

  6. potiuk commented on Aug 25, 2025

    @potiuk
    potiuk
    on Aug 25, 2025

    I agree it would be useful. We have just migrated airflow to prek from pre-commit and switched all (65) of our prek hools to inline the dependencies in airflow apache/airflow#54917 after prek 0.1.3 supports them.

    It would be great to. have dependabot could update those inline scripts dependencies.

  7. woodruffw commented on Oct 1, 2025

    @woodruffw
    woodruffw
    on Oct 1, 2025
    Author

    For others hitting this: I believe this is still an issue, including (unfortunately) with uv's script lockfile support: uv will correctly produce a <script>.lock file, but Dependabot appears to fail to discover it:

    Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+-----------------------------------------------------------------+
|                             Errors                              |
+---------------------------+-------------------------------------+
| Type                      | Details                             |
+---------------------------+-------------------------------------+
| dependency_file_not_found | {                                   |
|                           |   "message": "No files found in /", |
|                           |   "file-path": null                 |
|                           | }                                   |
+---------------------------+-------------------------------------+

    (That's with an action.py.lock file in the repository root.)

  8. markhallen
    self-assigned this
    on Dec 11, 2025
  9. markhallen
    moved this to In Progress in Dependaboton Dec 11, 2025
  10. markhallen
    removed their assignment
    on Dec 12, 2025

  11. Yarden-zamir commented on Aug 12, 2026

    @Yarden-zamir
    Yarden-zamir
    on Aug 12, 2026

    Is there any known workaround for this?

  12. yannikaMatt
    added a commit that references this issue on Aug 24, 2026

    ci: Group Dependabot updates and close pip-requirements gaps (acts-pr…

    242a0a9
  13. dimitra97
    added a commit that references this issue on Aug 25, 2026

    ci: Group Dependabot updates and close pip-requirements gaps (acts-pr…

    56b22a2
  14. stokkie90
    added a commit that references this issue on Sep 2, 2026

    Track Python deps via requirements.txt for Dependabot

    114b98f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    L: pythonL: python:uvT: feature-requestRequests for new features

    Type

    No type

    Projects

    • Dependabot
      Status
      In Progress

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions