chore(renovate): enable lock file maintenance - #8466
Draft
matthewelwell wants to merge 1 commit into
Draft
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 3 Skipped Deployments
|
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
api
matthewelwell
added a commit
that referenced
this pull request
Sep 4, 2026
Refreshes api/uv.lock the way Renovate's lock file maintenance would (#8466), with upper bounds added to the dependencies whose upgrades change CI outcomes rather than behaviour. Those upgrades are worth doing, but deliberately and one at a time, not as a side effect of a weekly refresh. Left unconstrained, the refresh produces 935 mypy errors and a test suite that does not collect. Constrained, it produces 38, and every one of them is a real finding rather than churn. 935 unconstrained 731 + dev toolchain constrained (mypy, stubs, pytest-django) 38 + django-lifecycle held below 1.2.5 Constraints: - django-lifecycle <1.2.5. 1.2.5 added a py.typed marker while leaving __init__, save, delete and refresh_from_db unannotated, so mypy stops treating the package as untyped and every call to those methods from typed code becomes a no-untyped-call error: ~490 of them. Held here; the upgrade and its fix are a separate PR. - mypy, djangorestframework-stubs, boto3-stubs pinned to their current minor. These decide what the type checker says about unchanged code. - pytest-django <4.9. 4.14 renames SettingsWrapper to Settings, which breaks the private test suites integrated from flagsmith-private by `make integrate-private-tests` - a repository this one cannot see and whose CI cannot catch the pairing. That rename needs to land there first. - pdbpp widened to >=0.12.1 rather than pinned. It was capped <0.11 while fancycompleter is transitive and unconstrained, so the refresh moved one and not the other; fancycompleter 0.11 removed LazyVersion, which pdbpp 0.10.3 calls at import time, and the entire suite died at collection. pdbpp 0.12.1 requires fancycompleter>=0.11.0, so the pair moves together. The remaining 38 were genuine. Most were stale `# type: ignore` comments that newer stubs made unnecessary. Three were defects the ignores were hiding: - get_permitted_projects, get_permitted_environments and has_environment_permission all declared `tag_ids: typing.List[int] = None` behind an ignore[assignment]; now `list[int] | None`. - get_identity_overrides_key_condition_expression was annotated `-> Key` but returns Key(...).eq(...), a ConditionBase, behind an ignore[return-value]. - _write_environments now materialises its Iterable once. Django's prefetch_related_objects wants a Sequence, and the write loop iterates the same argument again, so a generator would have been silently consumed before anything was written. mypy_boto3_dynamodb also renamed QueryInputRequestTypeDef; this code uses the Table resource API, so the replacement is QueryInputTableQueryTypeDef. Verified: `mypy .` clean across 1882 source files, ruff check and format clean, 107 tests covering the touched permission and model code passing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Renovate raises security PRs from manifest entries, so a CVE in a package that
appears only in a lock file is never actioned. That is the bulk of our exposure:
of 95 findings currently open against flagsmith-ee, which shares these four lock
files, 69 are transitive pins and only 26 are declared in a manifest.
There is no longer a dedicated option for this. transitiveRemediation, which
handled exactly this case, was npm@6-only and has been removed from Renovate; it
is absent from the current schema. Refreshing the lock file within existing
ranges is the only remaining mechanism that reaches transitive pins.
security:only-security-updates disables everything via a blanket
matchPackageNames ['*'] rule, so lock file maintenance needs an explicit
packageRule to escape it. The top-level block alone silently no-ops.
Measured against the real backlog before committing:
- frontend/ + docs/ `npm update --package-lock-only` clears 38 of 53 npm
findings. The rest are pinned by a parent or capped by a
declared range, and need an override or a manifest bump.
- mcp/ `uv lock --upgrade` clears both open findings.
- api/ see #8469, which lands the first refresh along with the
constraints that keep it reviewable.
api/ needs no special handling for CodeArtifact. renovate.yml already mints a
token over OIDC and passes it as RENOVATE_HOST_RULES; Renovate's uv processor
reads [[tool.uv.index]] from pyproject.toml, matches the host rule, and exports
UV_INDEX_FLAGSMITH_PYPI_PRODUCTION_{USERNAME,PASSWORD} for the uv subprocess -
precisely what `make codeartifact-login` writes. That path is already exercised
in production, since it is how Renovate resolves flagsmith-private versions for
the eager-bump rule.
Verified with `renovate --platform=local --dry-run=full` on
renovate/renovate:44.62.2-full: four lock file maintenance candidates, none
filtered, grouped into a single renovate/lock-file-maintenance branch. Config
validates against renovate 44.64.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
matthewelwell
force-pushed
the
chore/renovate-lockfile-maintenance
branch
from
September 4, 2026 16:58
0b9151d to
62cd23d
Compare
emyller
approved these changes
Sep 4, 2026
| ], | ||
| "lockFileMaintenance": { | ||
| "enabled": true, | ||
| "schedule": ["before 4am on monday"] |
Contributor
There was a problem hiding this comment.
note: they turned crontab into an LLM prompt? lol
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enable lock file maintenance in renovate which deletes and recreates all 4 lock files (
api/uv.lock,docs/package-lock.json,frontend/package-lock.jsonandmcp/uv.lock) once a week.This exists in order to work around the lack of transitive dependency support in renovate.
As I understand it, this will run as part of the self-hosted renovate flow that we are using, and hence should be correctly authenticated with code artifact, but that will need testing.
Related PR to refresh (most of)
api/uv.lockso we're not starting from scratch: #8469.