Support updating the uv lockfile for individual PEP 723 scripts

[rarkins]

Discussed in #33590

^{Originally posted by mjpieters January 13, 2025}

Tell us more.

Hi!

renovate already supports updating dependencies in a PEP 723 comment block in python scripts.

uv has since added support for a lockfile for such scripts:

% cat <<EOF > example.py
# /// script
# dependencies = [
#   "requests<3",
#   "rich",
# ]
# ///

import requests
from rich.pretty import pprint

resp = requests.get("https://peps.python.org/api/peps.json")
data = resp.json()
pprint([(k, v["title"]) for k, v in data.items()][:10])
EOF
% uv lock --script example.py
warning: No `requires-python` value found in the workspace. Defaulting to `>=3.12`.
Resolved 9 packages in 496ms
% ls -1
example.py
example.py.lock
% head example.py.lock
version = 1
requires-python = ">=3.12"

[manifest]
requirements = [
    { name = "requests", specifier = "<3" },
    { name = "rich" },
]

[[package]]

The lockfile has the same name as the script file with .lock appended, and the file format is the same as that for regular project lockfiles (uv.lock).

The feature is new in uv 0.5.17:

This release includes support for generating lockfiles from scripts based on inline metadata, as defined in PEP 723.

By default, scripts remain unlocked, and must be locked explicitly with uv lock --script /path/to/script.py, which will generate a lockfile adjacent to the script (e.g., script.py.lock). Once generated, the lockfile will be respected (and updated, if necessary) across uv run --script, uv add --script, and uv remove --script invocations.

This release also includes support for uv export --script and uv tree --script. Both commands support PEP 723 scripts with and without accompanying lockfiles.

It would be great if renovate could update these lockfiles.