Skip to content

Conversation

@corneliusroemer
Copy link
Contributor

@corneliusroemer corneliusroemer commented Jul 15, 2025

Summary

Renovate doesn't upgrade sha-pinned dependencies.

A sha pin on └mkdocs-github-admonitions-plugin was introduced due to a bug fix not being available in a released version in PR #18163

Now the bug fix has been released so the pin can be removed.

In the future, in such cases, it might be a good idea to add a comment
and/or set a reminder to look back and consider removing the pin
as renovate will not handle sha pins.

As renovate handles almost all dep upgrades, this provides a false sense
of "security" that deps are always kept up to date automatically.

Related to issue #19369

Thanks @ntBre for the pointer!

Test Plan

Docs previews should be visually inspected for correct rendering of admonitions.

As I'm not an Astral insider, I unfortunately can't actually faithfully reproduce the docs (due to Material for MkDocs being closed source). I don't know if there are automatic preview builds in CI that I can inspect instead.

Other

I also add a comment to remind the reader that renovate does not automatically update git/sha pinned dependencies. This was touched on in #19369 as well - I think this comment might be worth it but happy to remove of course if reviewers differ. It's not a big change, hence adding as piggyback commit to the PR that edits the same file.

Renovate doesn't upgrade sha-pinned dependencies.

The pin was introduced due to the bug fix not being available in a
released version in PR astral-sh#18163

Now the bug fix has been released so the pin can be removed.

In the future, in such cases, it might be a good idea to add a comment
and/or set a reminder to look back and consider removing the pin
as renovate will not handle sha pins.

As renovate handles almost all dep upgrades, this provides a false sense
of "security" that deps are always kept up to date automatically.

Related to issue astral-sh#19369

Thanks @ntBre for the pointer!
@MichaReiser MichaReiser requested a review from zanieb July 15, 2025 19:46
@MichaReiser
Copy link
Member

I'm not sure if we even use this version in the deployed docs but @zanieb will know better

@corneliusroemer
Copy link
Contributor Author

corneliusroemer commented Jul 15, 2025

@MichaReiser oh interesting, if the prod setup differs from what's on main, that might be a good thing to add the docs CONTRIBUTING.md section

Maybe as an addition to:

@ntBre ntBre added the dependencies Pull requests that update a dependency file label Jul 15, 2025
Copy link
Member

@MichaReiser MichaReiser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you. We should also update the regular requirements.txt file so that both insiders/non-insiders use the same versions (where possible)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants