dependabot-core Support for uv workspaces

Is there an existing issue for this?

[x] I have searched the existing issues

Package ecosystem

uv

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

/pyproject.toml

dependabot.yml content

version: 2
updates:
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "weekly"

Updated dependency

No response

What you expected to see, versus what you actually saw

if there is an internal dependencies in pyproject file:

[project]
dependencies = [
    ...
    "my-package"
]

[tool.uv.sources]
my_package = { workspace = true }

[tool.uv.workspace]
members = [
    "my_package",
]

job fails with an error:

2025/04/16 11:50:53 ERROR <job_999598316> Using CPython 3.12.9 interpreter at: /usr/local/.pyenv/versions/3.12.9/bin/python3.12
  × Failed to build `repo @
  │ file://dependabot_tmp_dir`
  ├─▶ Failed to parse entry: `my-package`
  ╰─▶ `my-package` references a workspace in `tool.uv.sources` (e.g., `my-package =
      { workspace = true }`), but is not a workspace member

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

Apr 16 '25 12:04 sevakva

Possibly related, I also get a crash with path dependencies as described in https://docs.astral.sh/uv/concepts/projects/workspaces/#when-not-to-use-workspaces.

Not sure if this needs to be handled differently to workspaces, but it's in the same neighborhood. Other pyproject files that are referred in the root file aren't fetched. The python file fetcher supports this: https://github.com/dependabot/dependabot-core/blob/417e889976765aef9fa3ffc0d57883bca55db428/python/lib/dependabot/python/file_fetcher.rb#L435-L449

The error from uv is:

Distribution not found at: file://dependabot_tmp_dir/path-dependency-name

Full stack trace

updater | 2025/06/12 06:31:47 INFO Updating mkdocstrings from 0.29.0 to 0.29.1
updater | 2025/06/12 06:31:47 INFO Setting up Python environment using LanguageVersionManager
updater | 2025/06/12 06:31:47 INFO Setting Python version to 3.11.11
updater | 2025/06/12 06:31:47 INFO Using pre-installed uv package
updater | 2025/06/12 06:31:47 INFO Running command: pyenv exec uv lock --upgrade-package mkdocstrings 
  proxy | 2025/06/12 06:31:47 [066] POST http://host.docker.internal:36961/update_jobs/cli/record_update_job_error
{"data":{"error-type":"unknown_error","error-details":null},"type":"record_update_job_error"}
  proxy | 2025/06/12 06:31:47 [066] 200 http://host.docker.internal:36961/update_jobs/cli/record_update_job_error
updater | 2025/06/12 06:31:47 ERROR Error processing mkdocstrings (Dependabot::SharedHelpers::HelperSubprocessFailed)
updater | 2025/06/12 06:31:47 ERROR Using CPython 3.11.11 interpreter at: /usr/local/.pyenv/versions/3.11.11/bin/python3.11
updater | error: Distribution not found at: file://dependabot_tmp_dir/path-dependency-name
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/common/lib/dependabot/shared_helpers.rb:488:in 'Dependabot::SharedHelpers.run_shell_command'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:179:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:179:in 'T::Private::Methods::CallValidation.validate_call_skip_block_type'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:121:in 'block in Dependabot::SharedHelpers.create_validator_slow_skip_block_type'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb:223:in 'Dependabot::Uv::FileUpdater::LockFileUpdater#run_command'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:179:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:179:in 'T::Private::Methods::CallValidation.validate_call_skip_block_type'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:121:in 'block in Dependabot::Uv::FileUpdater::LockFileUpdater#create_validator_slow_skip_block_type'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb:217:in 'Dependabot::Uv::FileUpdater::LockFileUpdater#run_update_command'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'block in Dependabot::Uv::FileUpdater::LockFileUpdater#create_validator_method_medium0'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb:201:in 'block (2 levels) in Dependabot::Uv::FileUpdater::LockFileUpdater#updated_lockfile_content_for'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/common/lib/dependabot/shared_helpers.rb:302:in 'Dependabot::SharedHelpers.with_git_configured'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'T::Private::Methods::CallValidation.validate_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:203:in 'block in Dependabot::SharedHelpers.create_validator_slow'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb:195:in 'block in Dependabot::Uv::FileUpdater::LockFileUpdater#updated_lockfile_content_for'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/common/lib/dependabot/shared_helpers.rb:81:in 'block in Dependabot::SharedHelpers.in_a_temporary_directory'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/common/lib/dependabot/shared_helpers.rb:81:in 'Dir.chdir'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/common/lib/dependabot/shared_helpers.rb:81:in 'Dependabot::SharedHelpers.in_a_temporary_directory'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'T::Private::Methods::CallValidation.validate_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:203:in 'block in Dependabot::SharedHelpers.create_validator_slow'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb:194:in 'Dependabot::Uv::FileUpdater::LockFileUpdater#updated_lockfile_content_for'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:108:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:108:in 'block in Dependabot::Uv::FileUpdater::LockFileUpdater#create_validator_method_fast1'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb:147:in 'Dependabot::Uv::FileUpdater::LockFileUpdater#updated_lockfile_content'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:59:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:59:in 'block in Dependabot::Uv::FileUpdater::LockFileUpdater#create_validator_method_fast0'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb:85:in 'Dependabot::Uv::FileUpdater::LockFileUpdater#fetch_updated_dependency_files'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'block in Dependabot::Uv::FileUpdater::LockFileUpdater#create_validator_method_medium0'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb:57:in 'Dependabot::Uv::FileUpdater::LockFileUpdater#updated_dependency_files'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'block in Dependabot::Uv::FileUpdater::LockFileUpdater#create_validator_method_medium0'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater.rb:78:in 'Dependabot::Uv::FileUpdater#updated_uv_lock_files'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'block in Dependabot::Uv::FileUpdater#create_validator_method_medium0'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/uv/lib/dependabot/uv/file_updater.rb:32:in 'Dependabot::Uv::FileUpdater#updated_dependency_files'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'block in Dependabot::Uv::FileUpdater#create_validator_method_medium0'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:144:in 'Dependabot::DependencyChangeBuilder#generate_dependency_files'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:919:in 'block in Dependabot::DependencyChangeBuilder#create_validator_method_medium0'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:72:in 'Dependabot::DependencyChangeBuilder#run'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:59:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:59:in 'block in Dependabot::DependencyChangeBuilder#create_validator_method_fast0'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:44:in 'Dependabot::DependencyChangeBuilder.create_from'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:179:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:179:in 'T::Private::Methods::CallValidation.validate_call_skip_block_type'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:121:in 'block in Dependabot::DependencyChangeBuilder.create_validator_slow_skip_block_type'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:171:in 'Dependabot::Updater::Operations::UpdateAllVersions#check_and_create_pull_request'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:687:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:687:in 'block in Dependabot::Updater::Operations::UpdateAllVersions#create_validator_procedure_fast1'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:94:in 'Dependabot::Updater::Operations::UpdateAllVersions#check_and_create_pr_with_error_handling'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:687:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation_2_7.rb:687:in 'block in Dependabot::Updater::Operations::UpdateAllVersions#create_validator_procedure_fast1'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:59:in 'block in Dependabot::Updater::Operations::UpdateAllVersions#perform'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:59:in 'Array#each'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:59:in 'Dependabot::Updater::Operations::UpdateAllVersions#perform'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'T::Private::Methods::CallValidation.validate_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/_methods.rb:277:in 'block in Dependabot::Updater::Operations::UpdateAllVersions#_on_method_added'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:137:in 'block in Dependabot::Updater::Operations::GroupUpdateAllVersions#run_ungrouped_dependency_updates'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:122:in 'Array#each'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:122:in 'Dependabot::Updater::Operations::GroupUpdateAllVersions#run_ungrouped_dependency_updates'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'T::Private::Methods::CallValidation.validate_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/_methods.rb:277:in 'block in Dependabot::Updater::Operations::GroupUpdateAllVersions#_on_method_added'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:65:in 'Dependabot::Updater::Operations::GroupUpdateAllVersions#perform'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'UnboundMethod#bind_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/call_validation.rb:282:in 'T::Private::Methods::CallValidation.validate_call'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.5.11952/lib/types/private/methods/_methods.rb:277:in 'block in Dependabot::Updater::Operations::GroupUpdateAllVersions#_on_method_added'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:45:in 'Dependabot::Updater#run'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/update_files_command.rb:45:in 'block in Dependabot::UpdateFilesCommand#perform_job'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.5.0/lib/opentelemetry/trace/tracer.rb:37:in 'block in OpenTelemetry::Trace::Tracer#in_span'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.5.0/lib/opentelemetry/trace.rb:70:in 'block in OpenTelemetry::Trace#with_span'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.5.0/lib/opentelemetry/context.rb:88:in 'OpenTelemetry::Context.with_value'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.5.0/lib/opentelemetry/trace.rb:70:in 'OpenTelemetry::Trace#with_span'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.5.0/lib/opentelemetry/trace/tracer.rb:37:in 'OpenTelemetry::Trace::Tracer#in_span'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/update_files_command.rb:18:in 'Dependabot::UpdateFilesCommand#perform_job'
updater | 2025/06/12 06:31:47 ERROR /home/dependabot/dependabot-updater/lib/dependabot/base_command.rb:37:in 'Dependabot::BaseCommand#run'
updater | 2025/06/12 06:31:47 ERROR bin/update_files.rb:44:in '<main>'