Skip to content

fix(manager/pep621): support array form of tool.uv.sources - #44970

Open
ntsk wants to merge 3 commits into
renovatebot:mainfrom
ntsk:fix/pep621-uv-sources-array
Open

fix(manager/pep621): support array form of tool.uv.sources#44970
ntsk wants to merge 3 commits into
renovatebot:mainfrom
ntsk:fix/pep621-uv-sources-array

Conversation

@ntsk

@ntsk ntsk commented Jul 30, 2026

Copy link
Copy Markdown

Changes

Reported in #44948

uv allows tool.uv.sources entries to be written as an array of sources, disambiguated by environment markers. A single-element array is valid too.
The pep621 schema only accepted the single-table form, and LooseRecord silently drops entries it can't parse, so array-form sources were ignored and lookups fell back to pypi.org.
For packages that only exist on the declared index this shows up as WARN: Package lookup failures.
For packages that also exist on pypi.org the problem is harder to notice: there is no warning, and Renovate silently proposes versions from the wrong registry.

What this PR does:

  • schema: sources now accepts a single source or an array of sources, normalized to an array
  • processor: when all sources of a dependency reference an index, all resolved index URLs are set as registryUrls (the pypi datasource merges releases across registries). A single non-index source behaves exactly as before.
  • multiple sources that are not all indexes (e.g. a git source per platform) get skipReason: 'unsupported'. Renovate can't represent them as a single update, and skipping is still better than the previous behavior of silently looking up pypi.org.

One thing this PR does not attempt: when markers don't cover every environment, uv falls back to the default index for the rest. Renovate doesn't evaluate markers, and the existing single-table handling has the same simplification, so I kept that behavior.

Context

Please select one of the following:

  • This closes an existing Issue, Closes: #
  • This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

  • No — I did not use AI for this contribution.
  • Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
  • Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
  • Yes — other (please describe):

Documentation (please check one with an [x])

  • I have updated the documentation, or
  • No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

  • Code inspection only, or
  • Newly added/modified unit tests, or
  • No unit tests, but ran on a real repository, or
  • Both unit tests + ran on a real repository

The public repository: https://github.com/ntsk/reproduce-array-form-uv-sources

The repo pins a package that only exists on test.pypi.org to a custom index using the array form.

DEBUG: GET https://pypi.org/pypi/ntsk-reproduce-array-form-uv-sources/json = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 ...)
DEBUG: Failed to look up pypi package ntsk-reproduce-array-form-uv-sources: no-result

With this branch (node lib/renovate.ts --platform=local in that repo):

"registryUrls": ["https://test.pypi.org/simple/"]

and the lookup failure is gone.

@github-actions
github-actions Bot requested a review from viceice July 30, 2026 15:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant