Manager for pre-commit additional_dependencies

[WilliamDEdwards]

Problem

Renovate supports bumping pre-commit hook versions (https://docs.renovatebot.com/modules/manager/pre-commit/).

But oftentimes, not only hooks are pinned to specific versions.

pre-commit also supports dependencies of hooks themselves (additional_dependencies, https://pre-commit.com/#config-additional_dependencies). Such dependencies are installed to the environment in which the hook is run.

In many circumstances, additional_dependencies ends up the same as out-of-config requirements files.

For example, here's the flake8 hook from a random internal repository:

- repo: https://github.com/PyCQA/flake8
  rev: 7.1.1
  hooks:
    - id: flake8
      # Keep in sync with .flake8. pre-commit does not
      # inherit 'exclude' config option from .flake8
      exclude: '^tests/'
      additional_dependencies:
        - flake8-bugbear==23.12.2
        - flake8-comprehensions==3.14.0
        - flake8-docstrings==1.7.0
        - flake8-junit-report==2.1.0
        - flake8-logging-format==0.9.0
        - flake8-pep3101==2.1.0
        - flake8-print==5.0.0
        - flake8-rst==0.8.0
        - flake8-rst-docstrings==0.3.0

... and here's the dev requirements file of that repository:

black==24.8.0
flake8==7.1.1
flake8-bugbear==24.4.26
flake8-comprehensions==3.15.0
flake8-docstrings==1.7.0
flake8-junit-report==2.1.0
flake8-logging-format==2024.24.12
flake8-pep3101==2.1.0
flake8-print==5.0.0
flake8-rst==0.8.0
flake8-rst-docstrings==0.3.0
isort==5.13.2
mypy==1.11.1
pre-commit==3.8.0

You will notice two things:

• Many dependencies are the same.
• Not all versions are identical.

Point two is the core of the issue: versions deviate between the pre-commit config and other requirements files. After all, there's nothing keeping them in sync.

Possible solutions

Below is all possible solutions to keep versions in sync between the pre-commit config and other requirements files.

Drop dev dependencies

Drop the dev dependencies outside the pre-commit config.

Disadvantage: not installing dev dependencies outside of pre-commit loses IDE support for e.g. mypy.

Use sync-pre-commit-deps

Use https://github.com/pre-commit/sync-pre-commit-deps.

Disadvantage: sync-pre-commit-deps is limited to black and flake8. It doesn't even support extras (such as flake8-bugbear), while such packages are common in the ecosystem. Not to mention that we install type stubs for mypy. sync-pre-commit-deps won't be expanded (see https://github.com/pre-commit/sync-pre-commit-deps).

Get dependencies from file

Don't duplicate dependencies, but let the pre-commit config get them from a general-purpose requirements file.

pre-commit doesn't and won't support this, at least not natively or without hacks (see pre-commit/pre-commit#730).

Bot

Write our own bot to keep additional_dependencies in sync.

The question is: in sync with what? A requirements file would have to be configured.

Request

If the only feasible solution is to write a bot, one could wonder if Renovate is the right place for a pre-commit additional_dependencies manager.

Judging by the activity in the aforementioned pre-commit issues, keeping dependencies in sync is quite a common problem, especially in the Python ecosystem.

Despite the commonness of this problem, @asottile has good architectural (and perhaps philosophical) reasons not to implement this in pre-commit (see pre-commit/pre-commit#1351 (comment)). I believe that Renovate isn't afflicted by the same.

Although Renovate's purpose isn't keeping dependencies in sync, its configurability would allow one to achieve this.

The same feature request exists for Dependabot: dependabot/dependabot-core#2040. Someone also 'abused' Renovate's flexibility to let it update the pre-commit config (dependabot/dependabot-core#2040 (comment)), but in a professional environment, it's not an option to rely on implementation details (at best, and hacks at worst).