rye dev dependencies are not updated by Dependabot

[evanbernstein]

Steps to Reproduce

1. Add dev dependencies via rye that are stale.
2. Configure Dependabot to use pip

Does Rye not document dev dependencies in pyproject.toml according to PEP621?

Expected Result

Dependabot will offer to upgrade stale dev dependencies. Its documentation says "In addition to supporting updates to requirements.txt files, Dependabot supports updates to pyproject.toml files if they follow the PEP 621 standard."

Actual Result

Dependabot does not offer to upgrade dev dependencies configured via Rye.

Version Info

0.32

Stacktrace

No response

[charliermarsh]

I don't think there's a good solution here since PEP 621 doesn't have support for development dependencies -- hence, Rye uses its non-standard tool.rye.dev-dependencies field. PEP 621 supports optional dependencies but those aren't quite the same thing, since they're included in the published package metadata.

[zanieb]

I feel like https://github.com/astral-sh/rye/discussions/504 may be a better place for this. Last I saw, Dependabot wasn't adding support for more tools and there's no standard place to put development dependencies. What action can be taken here?

[evanbernstein]

Thanks for the response @charliermarsh . I was afraid the answer was something like that, given my skim of PEP 621 (which was the first time I tried to read a PEP).

It seems like a solution is needed? I can use pipenv and have its dev dependencies updated, but, in all other respects, rye is suppier to pipenv except it doesn't play nice with Dependabot. Is this on the team's radar to address? Are you in communication with the Dependabot team at all?

[zanieb]

See https://github.com/dependabot/dependabot-core/issues/9368