Files
Michael Kriese 9ac59d69d7 test(manager): mark remaining unreachable manager guards (#46082)
* test(manager): close helmfile, hermit, leiningen and mix gaps

Adds a leiningen vector whose version references a variable that was
never defined, which yields no dep.

Marks six guards. The mix host rules were already filtered on a match
host and on the same regex, hermit tracks its packages as symlinks, and
the remaining three need a repository the helm login helper cannot
handle, an umbrella parent lock file that reads cleanly, or a dep name
carrying no organization.

The helmfile repository chain stays counted: `repoName` is only left
null when an oci dep was set, so its implicit else cannot run, and a
coverage-ignore hint does not attach to an `else if`.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

* test(manager): mark the nuget, ocb and pep621 guards

Twelve guards, none of which a test reaches. A global.json without an
sdk version is rejected a few lines earlier, and the nuget registry loop
always finds at least one url. The rest need inputs no fixture provides:
a blank ContainerBaseImage, a package reference pinned to a non-semver
value, a registry url with no protocol version, a host rule carrying
only a username or only a password, and a pixi manifest declaring its
requirement only under workspace.

The nuget lock file chain stays counted, since a coverage-ignore hint
does not attach to an `else if`.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

* test(manager): mark the python and vendir guards

Ten guards across pip-compile, pipenv, pixi, poetry and vendir. A
compile command always records its arguments, every lock file of a
package file is already in the sorted list, a python dep always carries
a current value, a successful parse always yields a value, and the
vendir vendor dir is always set. The rest need credentials no fixture
supplies, a requirement naming an undeclared index, or a source url
outside artifact registry.

The travis node_js chain stays counted, since a coverage-ignore hint
does not attach to an `else if`.

Co-Authored-By: Claude Opus 5 <michael.kriese+claude-code@mend.io>

* test(manager): close the deps-edn, docker-compose and pep723 gaps

Three of the remaining manager branches turn out to be reachable after
all.

The deps-edn extractor skipped an `aliases` value that is not a map; the
existing test only covered an alias *entry* that is not a map, so the
outer guard was never taken. A modern docker-compose file with an `x-`
extension that carries no image never reached the schema's extension
filter either, because the only such fixture omitted `services` and so
parsed as a v1 file. A PEP 723 script block without `requires-python`
was likewise untested.

Co-Authored-By: Claude Opus 5 (1M context) <michael.kriese+claude-code@mend.io>

* test(manager/nuget): cover a global.json with no sdk version

The `v8 ignore else` on the sdk-version check claimed the guard above it
rejects any global.json without one. That guard is
`!manifest['msbuild-sdks'] && !manifest.sdk?.version`, so it rejects only
when both are missing — a file carrying just `msbuild-sdks` passes it and
takes the else.

Replace the ignore with a test for that shape, plus one for an empty
`{}` document, which the guard does reject.

Co-Authored-By: Claude Opus 5 (1M context) <michael.kriese+claude-code@mend.io>

---------

Co-authored-by: Claude Opus 5 <michael.kriese+claude-code@mend.io>
2026-09-16 06:43:01 +00:00
..

The pip-compile manager does not support all use cases for pip-compile, so if you find any areas lacking and without an existing Issue then please "Suggest an Idea" in the Discussions forum with your use case.

The uv pip compile command is also supported through this manager in the same fashion as pip-compile.

The current implementation has some limitations. Read the full document before you start using the pip-compile manager.

Non-configured managerFilePatterns

The pip-compile manager has an empty array for default managerFilePatterns, meaning it won't match any files ever by default. You can "activate" the manager by specifying a managerFilePatterns pattern such as:

{
  "pip-compile": {
    "managerFilePatterns": ["/(^|/)requirements\\.txt$/"]
  }
}

pip-compile reads the output files to extract the arguments passed to the original command, as such the managerFilePatterns must be configured for *.txt files and not *.in.

Assumption of header with a command

As Renovate matches a pip-compile output file it will extract original command that was used to create it from header in this file. Because of that pip-compile manager poses restrictions on how this file is generated:

  • Use default header generation, don't use --no-header option.
  • Pass all source files explicitly.

In turn pip-compile manager will find all source files and parse them as package files using their respective managers.

The following files are currently supported:

Source filename Manager
pyproject.toml pep621
setup.py pip_setup
*.in pip_requirements

Example header:

#
# This file is autogenerated by pip-compile with Python 3.11
# by the following command:
#
#    pip-compile --no-emit-index-url --output-file=requirements.txt requirements.in
#

Conflicts with other managers

Because pip-compile will update source files with their associated manager you should disable them to avoid running these managers twice.

{
  "pip_requirements": {
    "enabled": false
  },
  "pip_setup": {
    "enabled": false
  }
}

Configuration of Python version

By default Renovate extracts Python version from the header for pip-compile, and from the --python-version option for uv. To get Renovate to use another version of Python, add a constraints` rule to the Renovate config:

{
  "constraints": {
    "python": "==3.7"
  }
}

pip-compile arguments

Renovate reads the requirements.txt file and extracts these pip-compile arguments:

  • source files as positional arguments
  • --output-file

All other allowed pip-compile arguments will be passed over without modification.

Transitive / indirect dependencies

This manager detects dependencies that only appear in lock files. They are disabled by default but can be forced to enable by vulnerability alerts. They will be upgraded with --upgrade-package option.