🚲 PR staged at http://34.133.220.217

They all update transitive Python dependencies by modifying only the requirements.txt file, instead of updating the requirements.txt file first.

Do you mean "instead of updating the requirements.txt file first"?
I'm good with this, maybe there can be a way for renovate-bot to exclusively look at the modules in the requirements.in file (I wonder why that pip-compile field is not enough to specify that 🤔 )

LGTM!

🚲 PR staged at http://34.133.220.217

... maybe there can be a way for renovate-bot to exclusively look at the modules in the requirements.in file
(I wonder why that pip-compile field is not enough to specify that 🤔 )

Good question.

Christine and I just did some digging and decided to keep pip-compile enabled and disable pip_requirements.
I have updated this pull-request accordingly — instead of disabling python, we now only disable pip_requirements.

Background Info

• pip-compile and pip_requirements are Renovate Bot managers.
• pip-compile is considered to be in "alpha" stage, so it's not enabled by default.
• pip-compile targets the requirements.in file.
• pip-compile will still create PRs that only update the requirements.txt file because of lock file maintenance, but these PRs are good.
• pip_requirements doesn't look at or touch requirements.in files and only ever updates the requirements.txt file.

Looks like this is not behaving as expected, for example in the PRs opened this morning

• chore(deps): update dependency rsa to v4.8 part2 #771
• chore(deps): update dependency protobuf to v3.20.0 #769
• chore(deps): update dependency opencensus-ext-stackdriver to v0.8.0 #768
• chore(deps): update dependency opencensus to v0.8.0 #767

The requirements.in files are being updated, but now the requirements.txt files are not getting updated

I think we should try this renovatebot/renovate#10407 (comment)
and https://docs.renovatebot.com/configuration-options/#lockfilemaintenance
Maybe something like this?

...
  "pip-compile": {
    "enabled": true,
    "fileMatch": ["(^|/)requirements\\.in$"],
    "lockFileMaintenance": {
      "enabled": true
    }
  },
  "pip_requirements": {
    "enabled": false
  }

The requirements.in files are being updated, but now the requirements.txt files are not getting updated

Oh no. This is a fun game of whack-a-mole. 😄

Thanks for sharing those links and bringing this to our attention, Christine.
From your link:

lockFileMaintenance ... This feature is disabled by default.

I see. Let's try your suggestion of adding:

    "lockFileMaintenance": {
      "enabled": true
    }

🤞

ty folks for these good writeups! I faced the same thing this week and randomly found this very helpful conversation :)