In our work, we are using renovate to update the dependency packages for Python projects. Previously when we are using good old pip and requirements.txt for package management, renovate works fine since it only needs to update the package version in requirements.txt. We switch to uv this year as our project management tool. Since uv uses pyproject.toml and uv.lock (lockfile) to ensure reproducible project setup, we have an issue that when renovate bot creates a PR for the package updates: it only changes pyproject.toml without updating uv.lock.

Of course, we can manually pull the PR and run uv lock and push changes, but this is annoying for every renovate bot PR.

Note that we are using Azure DevOps and self-hosted renovate running in Azure DevOps pipeline.

Let renovate manage the lockfile#

You can enable the lockfile maintenance support in renovate:

{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  lockFileMaintenance: {
    enabled: true,
  }
}

Since we are using self-hosted renovate, we also have this in our config.js:

// https://docs.renovatebot.com/self-hosted-configuration/#binarysource
binarySource: 'install',

set up github token#

However, when the renovate is creating the PR, the uv.lock file is still not updated. In the log, we found some issues:

“artifactErrors”: [{“fileName”: “uv.lock”, “stderr”: “No tool releases found.”}] github.com token 401 unauthorized

As is suggested in this post, the github token needs to be set up correctly. Renovate needs the github token to get the latest release the tool (uv) to install and perform the lockfile update.

Install tools inside Docker#

Or we can also pre-install the tools inside the renovate Dockerfile:

FROM renovate/renovate:latest

# Install uv directly into the bot image
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

use the full docker image#

To avoid installing the tools on the fly and make it just work. The renovate full image can also be used:

FROM renovate/renovate:full

References#

• https://docs.astral.sh/uv/guides/integration/renovate/