dependabot / dependabot/dependabot-core

[uv] `requires-python` with `~=` in `uv`'s `pyproject.toml` is causing dependency graph failures

Open
#14,883 2 comments 1 reaction 0 assignees View on GitHub
L: git:submodules L: java:gradle L: javascript L: python L: python:uv T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

uv

### Package manager version

N/A (Dependency Graph workflow in GA)

### Language version

Python 3.14.3

### Manifest location and content before the Dependabot update

the manifest `pyproject.toml` is location in the root of the repo.

```toml
[project]
requires-python = "~=3.14.3"
```

### dependabot.yml content

N/A (this is the Dependency Graph automatic workflow as far as I can tell)

Image

I actually don't understand when/why this appeared in Github Actions. I'd never seen it before and Dependency graph + Dependabot used to work just fine, including on pip manifests, uv's pyproject.toml, etc. Nothing changed on my end but it started failing out of the blue.

### Updated dependency

N/A

### What you expected to see, versus what you actually saw

Expected: `~=3.14.3` (equivalent to `>=3.14.3,<3.15.0` per [PEP 440](https://peps.python.org/pep-0440/)) should be resolved against the supported `3.14.*` line.

Actual:
```
Currently, the following Python versions are supported in Dependabot: 3.9.*, 3.10.*, 3.11.*, 3.12.*, 3.13.*, 3.14.*.
...
updater | 2026/04/30 17:55:13 INFO Finished job processing
updater | 2026/04/30 17:55:13 INFO Results:
Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+------------------------------------------------------------------------------------------------------+
| Errors |
+----------------------------+-------------------------------------------------------------------------+
| Type | Details |
+----------------------------+-------------------------------------------------------------------------+
| tool_version_not_supported | { |
| | "tool-name": "Python", |
| | "detected-version": "~=3.14.3", |
| | "supported-versions": "3.9.*, 3.10.*, 3.11.*, 3.12.*, 3.13.*, 3.14.*" |
| | } |
+----------------------------+-------------------------------------------------------------------------+
```

### Native package manager behavior

`uv` handles `requires-python = "~=3.14.3"` correctly. it installs the latest 3.14.x

### Images of the diff or a link to the PR, issue, or logs

I shared the exact error above, but here's more info from the workflow run (somewhat sanitized for privacy):

```
Run github/dependabot-action@main
🤖 ~ starting update ~
Fetching job details
Pulling updater images
Starting update process
Created proxy container:
Created container:
proxy | 2026/04/30 17:55:06 proxy starting, commit: 2803a0f0dec888dc2b556d1a9bea8a9d771f8167
2026/04/30 17:55:06 Listening (:1080)
Started container
updater | Updating certificates in /etc/ssl/certs...
updater | rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
updater | 1 added, 0 removed; done.
updater | Running hooks in /etc/ca-certificates/update.d...
updater | done.
updater | fetch_files command is no longer used directly
updater | 2026/04/30 17:55:10 INFO Starting job processing
updater | 2026/04/30 17:55:10 INFO Job definition: {"job":{"command":"graph","allowed-updates":[{"dependency-type":"direct","update-type":"all"}],"commit-message-options":{"prefix":null,"prefix-development":null,"include-scope":null},"credentials-metadata":[{"type":"git_source","host":"github.com"}],"debug":null,"dependencies":null,"dependency-groups":[],"dependency-group-to-refresh":null,"existing-pull-requests":[],"existing-group-pull-requests":[],"experiments":{"record-ecosystem-versions":true,"record-update-job-unknown-error":true,"proxy-cached":true,"enable-corepack-for-npm-and-yarn":true,"enable-private-registry-for-corepack":true,"allow-refresh-for-existing-pr-dependencies":true,"allow-refresh-group-with-all-dependencies":true,"azure-registry-backup":true,"enable-enhanced-error-details-for-updater":true,"gradle-lockfile-updater":true,"enable-exclude-paths-subdirectory-manifest-files":true,"group-membership-enforcement":true,"python-requirements-file-name-filtering":true},"ignore-conditions":[],"lockfile-only":false,"max-updater-run-time":2700,"package-manager":"uv","requirements-update-strategy":null,"reject-external-code":false,"security-advisories":[],"security-updates-only":false,"source":{"provider":"github","repo":"/","branch":null,"api-endpoint":"https://api.github.com/","hostname":"github.com","directories":["/.","/requirements"]},"updating-a-pull-request":false,"update-subdependencies":false,"vendor-dependencies":false,"enable-beta-ecosystems":false,"repo-private":true,"multi-ecosystem-update":false,"exclude-paths":[]}}
proxy | 2026/04/30 17:55:10 [002] GET https://github.com:443//.git/info/refs?service=git-upload-pack
2026/04/30 17:55:10 [002] * authenticating git server request (host: github.com)
proxy | 2026/04/30 17:55:10 [002] 200 https://github.com:443//.git/info/refs?service=git-upload-pack
updater | 2026/04/30 17:55:10 INFO Started process PID: 1167 with command: {} git clone --no-tags --depth 1 --recurse-submodules --shallow-submodules https://github.com// /home/dependabot/dependabot-updater/repo {}
proxy | 2026/04/30 17:55:10 [004] GET https://github.com:443///info/refs?service=git-upload-pack
2026/04/30 17:55:10 [004] * authenticating git server request (host: github.com)
proxy | 2026/04/30 17:55:10 [004] 200 https://github.com:443///info/refs?service=git-upload-pack
proxy | 2026/04/30 17:55:10 [006] POST https://github.com:443///git-upload-pack
2026/04/30 17:55:10 [006] * authenticating git server request (host: github.com)
proxy | 2026/04/30 17:55:10 [006] 200 https://github.com:443///git-upload-pack
proxy | 2026/04/30 17:55:11 [008] POST https://github.com:443///git-upload-pack
2026/04/30 17:55:11 [008] * authenticating git server request (host: github.com)
proxy | 2026/04/30 17:55:11 [008] 200 https://github.com:443///git-upload-pack
updater | 2026/04/30 17:55:11 INFO Process PID: 1167 completed with status: pid 1167 exit 0
updater | 2026/04/30 17:55:11 INFO Total execution time: 1.16 seconds
updater | 2026/04/30 17:55:12 ERROR Error during file fetching; aborting: Dependabot detected the following Python requirement for your project: '~=3.14.3'.

Currently, the following Python versions are supported in Dependabot: 3.9.*, 3.10.*, 3.11.*, 3.12.*, 3.13.*, 3.14.*.
updater | 2026/04/30 17:55:13 INFO Finished job processing
updater | 2026/04/30 17:55:13 INFO Results:
Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+------------------------------------------------------------------------------------------------------+
| Errors |
+----------------------------+-------------------------------------------------------------------------+
| Type | Details |
+----------------------------+-------------------------------------------------------------------------+
| tool_version_not_supported | { |
| | "tool-name": "Python", |
| | "detected-version": "~=3.14.3", |
| | "supported-versions": "3.9.*, 3.10.*, 3.11.*, 3.12.*, 3.13.*, 3.14.*" |
| | } |
+----------------------------+-------------------------------------------------------------------------+
```

On a side-note, I did find #13707 but it seems to be a separate problem re: dependency version constraints of individual packages, not the python version.

### Smallest manifest that reproduces the issue

```toml
[project]
name = "repro"
version = "0.1.0"
requires-python = "~=3.14.3"
dependencies = []
```

Contributor guide

Open the contributing guide

Research direction

Start with the minimal root pyproject.toml reproduction containing requires-python = "~=3.14.3", then run the Dependency Graph workflow and review the Dependabot logs. Trace how the uv updater interprets this requirement; done means the constraint resolves against the supported 3.14.* line instead of producing tool_version_not_supported.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.