How to understand the pinned version in default update strategy --update-resure.

[huxuan]

Background:

I have a project with pydantic-settings (with no constraints) [1] as dependencies and leverage renovate to update the lock file [2]. According to the implementation [3][4] in renovate, looks like the executed command is pdm update --no-sync, which means the default strategy --update-reuse is used. But I notice that, pydantic related packages are never been updated. I tried to investigate on the related implementation in pdm, it seems to be related to the pydantic-core==2.14.5 constraints of the installed pydantic package in version 2.5.2 which is almost half an year ago.

So my questions would be:

1. How to understand the default update strategy --update-reuse? It might be intuitive if I specified the dependency to be something like pydantic-setting==X.X.X, but currently seems an indriect pinned version will also take effect.
2. What is the recommended strategy if I want to keep the dependencies updated? Seem the default update strategy for the pdm-project/update-deps-action action is also reuse, but maybe we should use --update-all instead?

[1] https://github.com/serious-scaffold/ss-python/blob/3e6e0728bafc33b3a15a244a756d003b2409f54e/pyproject.toml#L22
[2] https://docs.renovatebot.com/configuration-options/#lockfilemaintenance
[3] https://github.com/renovatebot/renovate/blob/3c75e4bfb3e6786508f57ead837af102d468f4ab/lib/modules/manager/pep621/processors/pdm.ts#L20
[4] https://github.com/renovatebot/renovate/blob/3c75e4bfb3e6786508f57ead837af102d468f4ab/lib/modules/manager/pep621/processors/pdm.ts#L126

[frostming]

I don't think there is much to respond because it is documented at https://pdm-project.org/en/latest/usage/dependency/#about-update-strategy. For your use case I would recommend eager

[huxuan]

Hi @frostming, thanks for the reponse.

it is documented at https://pdm-project.org/en/latest/usage/dependency/#about-update-strategy

Actually, what got me confused is just the documentation. In the documentation, it says "locked dependencies" while "pinned versions" is used to express the same meaning in CLI help.

For your use case I would recommend eager

The documentation of eager update strategy also makes me confused, but I find the answer in the code [1]. The documentation says it only update packages (and their recurisive sub-dependencies) specified in the command line, but for the lock file maintenance, pdm update --no-sync is executed without speicfing any packages. It turns out when no package is specified, all packages are selected. So maybe my question would be how does pdm deal with the "pinned versions" or "locked dependencies".

BTW, IIUC, the lock file maintenance works just like the action pdm-project/update-deps-action, if the recommended update strategy, would you think it is OK to set the default strategy [2] to eager?

[1]

pdm/src/pdm/cli/commands/update.py

Lines 127 to 133 in 80594e4

	if not packages:
	if prerelease is not None:
	raise PdmUsageError("--prerelease/--stable must be used with packages given")
	selection.validate()
	for group in selection:
	updated_deps[group] = all_dependencies[group]
	tracked_names.update(chain.from_iterable(updated_deps.values()))

[2] https://github.com/pdm-project/update-deps-action/blob/220b51345905dbf3737390f2db880b10bbf9e530/action.yml#L19

[frostming]

eager means the selected dependency(in pyproject.toml) and its recursive dependencies.

When no package is given, the dependencies from pyproject.toml will be used, but since all locked packages(=pinned versions) come from those dependencies, this is nearly the same as update-all

[huxuan]

Thanks, @frostming. I created a pull request for renovate renovatebot/renovate#29183. Please let me know if you have any concern.