Possible to skip resolution of specific dep group?

[ossimoi]

Using Renovate for automated dependency upgrades but locking fails on projects that have local editable dependencies outside of project root. Is it possible, in combination with "--without " to disable resolution of those deps altogether?

[huxuan]

AFAIK, the command used for lockFileMaintenance in Renovate is fixed [1], and actually pdm update does support --without.

Instead, maybe you can leverage multiple lockfiles [2], and export only those specific groups to the main pdm.lock file. In this way, Renovate will only update the specific groups.

[1] https://github.com/renovatebot/renovate/blob/f78d439d4754d659f739924456f87084cffc8ffe/lib/modules/manager/pep621/processors/pdm.ts#L20
[2] https://pdm-project.org/latest/usage/lockfile/#specify-another-lock-file-to-use

[huxuan]

Is there any reproducible repo or renovate logs?

[ossimoi]

No repo but this is fairly easy to reproduce:

pdm add -dG localdep -e ../another_project
mv ../another_project ../another_project_missing
rm pdm.lock
pdm update --without localdep

[RequirementError]: file:///${PROJECT_ROOT}/../another_project: Editable requirement is only supported for VCS link or local directory.

Renovate also fails with this error. Locking without localdep to pdm.lock.prod and then doing pdm update --without localdep --lockfile pdm.lock.prod does not work either.

[huxuan]

Another case could be one project has all the dependencies locked in the main pdm.lock file but only want to update selected groups, in this way, we have to read all the dependencies instead of seletected one in order to generate the lock file.

Instead of "local editable dependencies outside of project root" , it looks like you need monorepo or workspace support.

[ossimoi]

Monorepo won't work for us, workspaces could help a bit.

We have bunch of projects that depend on a set of libs. What we're trying to avoid is locking those libs and their deps in each project. Libs are already installed in the base environment when deploying to production, and local development always uses the latest version of those libs and their dependencies. I know this is against packaging principals but still adding this feature would allow some flexibility in cases like this, wdyt?

[huxuan]

Sorry, I am not the maintainer so I can not make the decision. But after looking through the releated implementation, it will bring more ambiguity just as I explained. An intuitive idea is to only parse the requirements listed in specified lock files, this will harm the performance I think.

For your cases, I am not sure whether VCS dependencies [1] will help.

[1] https://pdm-project.org/en/stable/usage/dependency/#vcs-dependencies