Skip to content

Move dependency versions to single JSON and enable Renovate#9559

Open
hugovk wants to merge 1 commit intopython-pillow:mainfrom
hugovk:renovate-dependencies
Open

Move dependency versions to single JSON and enable Renovate#9559
hugovk wants to merge 1 commit intopython-pillow:mainfrom
hugovk:renovate-dependencies

Conversation

@hugovk
Copy link
Copy Markdown
Member

@hugovk hugovk commented Apr 11, 2026

Right now, we have the versions for our dependencies split between:

  • winbuild/build_prepare.py - called when building Windows wheels
  • .github/workflows/wheels-dependencies.sh - called when building all other wheels

And updating them is a lot of manual work:

By having them managed by Renovate we:

  • automate the update PRs
  • get them on a schedule rather than many times throughout the month
  • have a cooldown applied to protect from supply chain attacks
  • avoid duplicating in build_prepare.py and wheels-dependencies.sh
  • avoid triplicating in the SBOM (Generate CycloneDX SBOM at release time via CI #9550) -- the WIP mostly doesn't include dep versions, but it should, and could be read from this file

Here's a demo on my fork, where I downgraded all the deps to see if it would pick them up, and it has: hugovk#153

@hugovk hugovk force-pushed the renovate-dependencies branch from e0204a8 to 7d547dd Compare April 11, 2026 19:43
@hugovk hugovk force-pushed the renovate-dependencies branch from 35334a3 to c78c5f5 Compare April 11, 2026 20:05
Copy link
Copy Markdown
Member

@aclark4life aclark4life left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

],
"minimumReleaseAge": "7 days",
"schedule": [
"* */1 * * *"
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect you only increased the schedule frequency for testing purposes?

"extends": [
"config:recommended"
],
"forkProcessing": "enabled",
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This also looks like a test setting.

Comment on lines +98 to +99
"packageNameTemplate": "libsdl-org/libtiff",
"datasourceTemplate": "github-tags",
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"packageNameTemplate": "libsdl-org/libtiff",
"datasourceTemplate": "github-tags",
"packageNameTemplate": "libtiff/libtiff",
"datasourceTemplate": "gitlab-tags",

https://github.com/libsdl-org/libtiff links to GitLab under 'Source code repository' in the README

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants