use pip-compile and dependabot grouped updates (#5329)

.github/dependabot.yml

@@ -1,9 +1,18 @@
 version: 2
 updates:
-- package-ecosystem: "github-actions"
+  - package-ecosystem: github-actions
-  directory: "/"
+    directory: /
-  schedule:
+    schedule:
-    interval: "monthly"
+      interval: monthly
-    day: "monday"
+    groups:
-    time: "16:00"
+      github-actions:
-    timezone: "UTC"
+        patterns:
+          - '*'
+  - package-ecosystem: pip
+    directory: /requirements/
+    schedule:
+      interval: monthly
+    groups:
+      python-requirements:
+        patterns:
+          - '*'

.github/workflows/lock.yaml

@@ -1,8 +1,8 @@
-name: 'Lock threads'
+name: 'Lock inactive closed issues'
-# Lock closed issues that have not received any further activity for
+# Lock closed issues that have not received any further activity for two weeks.
-# two weeks. This does not close open issues, only humans may do that.
+# This does not close open issues, only humans may do that. We find that it is
-# We find that it is easier to respond to new issues with fresh examples
+# easier to respond to new issues with fresh examples rather than continuing
-# rather than continuing discussions on old issues.
+# discussions on old issues.
 
 on:
   schedule:

.github/workflows/publish.yaml

@@ -13,8 +13,8 @@ jobs:
       - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
         with:
           python-version: '3.x'
-          cache: 'pip'
+          cache: pip
-          cache-dependency-path: 'requirements/*.txt'
+          cache-dependency-path: requirements*/*.txt
       - run: pip install -r requirements/build.txt
       # Use the commit date instead of the current date during the build.
       - run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
@@ -27,7 +27,7 @@ jobs:
         with:
           path: ./dist
   provenance:
-    needs: ['build']
+    needs: [build]
     permissions:
       actions: read
       id-token: write
@@ -39,7 +39,7 @@ jobs:
   create-release:
     # Upload the sdist, wheels, and provenance to a GitHub release. They remain
     # available as build artifacts for a while as well.
-    needs: ['provenance']
+    needs: [provenance]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -53,16 +53,15 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
   publish-pypi:
-    needs: ['provenance']
+    needs: [provenance]
     # Wait for approval before attempting to upload to PyPI. This allows reviewing the
     # files in the draft release.
-    environment: 'publish'
+    environment: publish
     runs-on: ubuntu-latest
     permissions:
       id-token: write
     steps:
       - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
-      # Try uploading to Test PyPI first, in case something fails.
       - uses: pypa/gh-action-pypi-publish@b7f401de30cb6434a1e19f805ff006643653240e
         with:
           repository-url: https://test.pypi.org/legacy/

.github/workflows/tests.yaml

@@ -9,9 +9,6 @@ on:
       - '*.md'
       - '*.rst'
   pull_request:
-    branches:
-      - main
-      - '*.x'
     paths-ignore:
       - 'docs/**'
       - '*.md'
@@ -24,24 +21,24 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - {name: Linux, python: '3.11', os: ubuntu-latest, tox: py311}
+          - {name: Linux, python: '3.12', os: ubuntu-latest, tox: py312}
-          - {name: Windows, python: '3.11', os: windows-latest, tox: py311}
+          - {name: Windows, python: '3.12', os: windows-latest, tox: py312}
-          - {name: Mac, python: '3.11', os: macos-latest, tox: py311}
+          - {name: Mac, python: '3.12', os: macos-latest, tox: py312}
-          - {name: '3.12-dev', python: '3.12-dev', os: ubuntu-latest, tox: py312}
+          - {name: '3.11', python: '3.11', os: ubuntu-latest, tox: py311}
           - {name: '3.10', python: '3.10', os: ubuntu-latest, tox: py310}
           - {name: '3.9', python: '3.9', os: ubuntu-latest, tox: py39}
           - {name: '3.8', python: '3.8', os: ubuntu-latest, tox: py38}
           - {name: 'PyPy', python: 'pypy-3.10', os: ubuntu-latest, tox: pypy310}
-          - {name: 'Minimum Versions', python: '3.11', os: ubuntu-latest, tox: py311-min}
+          - {name: 'Minimum Versions', python: '3.12', os: ubuntu-latest, tox: py312-min}
           - {name: 'Development Versions', python: '3.8', os: ubuntu-latest, tox: py38-dev}
-          - {name: Typing, python: '3.11', os: ubuntu-latest, tox: typing}
+          - {name: Typing, python: '3.12', os: ubuntu-latest, tox: typing}
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
       - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
         with:
           python-version: ${{ matrix.python }}
           cache: 'pip'
-          cache-dependency-path: 'requirements/*.txt'
+          cache-dependency-path: requirements*/*.txt
       - name: cache mypy
         uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
         with:

.pre-commit-config.yaml

@@ -25,10 +25,6 @@ repos:
         additional_dependencies:
           - flake8-bugbear
           - flake8-implicit-str-concat
-  - repo: https://github.com/peterdemin/pip-compile-multi
-    rev: v2.6.3
-    hooks:
-      - id: pip-compile-multi-verify
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.4.0
     hooks:

.readthedocs.yaml

@@ -1,8 +1,8 @@
 version: 2
 build:
-  os: ubuntu-20.04
+  os: ubuntu-22.04
   tools:
-    python: "3.10"
+    python: "3.12"
 python:
   install:
     - requirements: requirements/docs.txt

requirements-skip/README.md

@@ -0,0 +1,2 @@
+Dependabot will only update files in the `requirements` directory. This directory is
+separate because the pins in here should not be updated automatically.

requirements-skip/tests-dev.txt

@@ -0,0 +1,6 @@
+https://github.com/pallets/werkzeug/archive/refs/heads/main.tar.gz
+https://github.com/pallets/jinja/archive/refs/heads/main.tar.gz
+https://github.com/pallets/markupsafe/archive/refs/heads/main.tar.gz
+https://github.com/pallets/itsdangerous/archive/refs/heads/main.tar.gz
+https://github.com/pallets/click/archive/refs/heads/main.tar.gz
+https://github.com/pallets-eco/blinker/archive/refs/heads/main.tar.gz

requirements-skip/tests-min.in

@@ -1,6 +1,6 @@
-Werkzeug==3.0.0
+werkzeug==3.0.0
-Jinja2==3.1.2
+jinja2==3.1.2
-MarkupSafe==2.1.1
+markupsafe==2.1.1
 itsdangerous==2.1.2
 click==8.1.3
 blinker==1.6.2

requirements-skip/tests-min.txt

@@ -0,0 +1,21 @@
+#
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
+#
+#    pip-compile tests-min.in
+#
+blinker==1.6.2
+    # via -r tests-min.in
+click==8.1.3
+    # via -r tests-min.in
+itsdangerous==2.1.2
+    # via -r tests-min.in
+jinja2==3.1.2
+    # via -r tests-min.in
+markupsafe==2.1.1
+    # via
+    #   -r tests-min.in
+    #   jinja2
+    #   werkzeug
+werkzeug==3.0.0
+    # via -r tests-min.in

requirements/build.txt

@@ -1,13 +1,12 @@
-# SHA1:80754af91bfb6d1073585b046fe0a474ce868509
 #
-# This file is autogenerated by pip-compile-multi
+# This file is autogenerated by pip-compile with Python 3.11
-# To update, run:
+# by the following command:
 #
-#    pip-compile-multi
+#    pip-compile build.in
 #
-build==0.10.0
+build==1.0.3
-    # via -r requirements/build.in
+    # via -r build.in
-packaging==23.1
+packaging==23.2
     # via build
 pyproject-hooks==1.0.0
     # via build

requirements/dev.in

@@ -1,6 +1,6 @@
 -r docs.in
 -r tests.in
 -r typing.in
-pip-compile-multi
+pip-tools
 pre-commit
 tox

requirements/dev.txt

@@ -1,62 +1,150 @@
-# SHA1:54b5b77ec8c7a0064ffa93b2fd16cb0130ba177c
 #
-# This file is autogenerated by pip-compile-multi
+# This file is autogenerated by pip-compile with Python 3.11
-# To update, run:
+# by the following command:
 #
-#    pip-compile-multi
+#    pip-compile dev.in
 #
--r docs.txt
+alabaster==0.7.13
--r tests.txt
+    # via sphinx
--r typing.txt
+asgiref==3.7.2
-build==0.10.0
+    # via -r tests.in
+babel==2.13.1
+    # via sphinx
+build==1.0.3
     # via pip-tools
-cachetools==5.3.1
+cachetools==5.3.2
     # via tox
+certifi==2023.7.22
+    # via requests
+cffi==1.16.0
+    # via cryptography
 cfgv==3.4.0
     # via pre-commit
 chardet==5.2.0
     # via tox
-click==8.1.6
+charset-normalizer==3.3.2
-    # via
+    # via requests
-    #   pip-compile-multi
+click==8.1.7
-    #   pip-tools
+    # via pip-tools
 colorama==0.4.6
     # via tox
+cryptography==41.0.5
+    # via -r typing.in
 distlib==0.3.7
     # via virtualenv
-filelock==3.12.2
+docutils==0.18.1
+    # via
+    #   sphinx
+    #   sphinx-tabs
+filelock==3.13.1
     # via
     #   tox
     #   virtualenv
-identify==2.5.26
+identify==2.5.31
     # via pre-commit
+idna==3.4
+    # via requests
+imagesize==1.4.1
+    # via sphinx
+iniconfig==2.0.0
+    # via pytest
+jinja2==3.1.2
+    # via sphinx
+markupsafe==2.1.3
+    # via jinja2
+mypy==1.6.1
+    # via -r typing.in
+mypy-extensions==1.0.0
+    # via mypy
 nodeenv==1.8.0
     # via pre-commit
-pip-compile-multi==2.6.3
+packaging==23.2
-    # via -r requirements/dev.in
+    # via
+    #   build
+    #   pallets-sphinx-themes
+    #   pyproject-api
+    #   pytest
+    #   sphinx
+    #   tox
+pallets-sphinx-themes==2.1.1
+    # via -r docs.in
 pip-tools==7.3.0
-    # via pip-compile-multi
+    # via -r dev.in
-platformdirs==3.10.0
+platformdirs==3.11.0
     # via
     #   tox
     #   virtualenv
-pre-commit==3.3.3
+pluggy==1.3.0
-    # via -r requirements/dev.in
+    # via
-pyproject-api==1.5.3
+    #   pytest
+    #   tox
+pre-commit==3.5.0
+    # via -r dev.in
+pycparser==2.21
+    # via cffi
+pygments==2.16.1
+    # via
+    #   sphinx
+    #   sphinx-tabs
+pyproject-api==1.6.1
     # via tox
 pyproject-hooks==1.0.0
     # via build
+pytest==7.4.3
+    # via -r tests.in
+python-dotenv==1.0.0
+    # via -r tests.in
 pyyaml==6.0.1
     # via pre-commit
-toposort==1.10
+requests==2.31.0
-    # via pip-compile-multi
+    # via sphinx
-tox==4.9.0
+snowballstemmer==2.2.0
-    # via -r requirements/dev.in
+    # via sphinx
-virtualenv==20.24.3
+sphinx==7.2.6
+    # via
+    #   -r docs.in
+    #   pallets-sphinx-themes
+    #   sphinx-issues
+    #   sphinx-tabs
+    #   sphinxcontrib-applehelp
+    #   sphinxcontrib-devhelp
+    #   sphinxcontrib-htmlhelp
+    #   sphinxcontrib-log-cabinet
+    #   sphinxcontrib-qthelp
+    #   sphinxcontrib-serializinghtml
+sphinx-issues==3.0.1
+    # via -r docs.in
+sphinx-tabs==3.4.4
+    # via -r docs.in
+sphinxcontrib-applehelp==1.0.7
+    # via sphinx
+sphinxcontrib-devhelp==1.0.5
+    # via sphinx
+sphinxcontrib-htmlhelp==2.0.4
+    # via sphinx
+sphinxcontrib-jsmath==1.0.1
+    # via sphinx
+sphinxcontrib-log-cabinet==1.0.1
+    # via -r docs.in
+sphinxcontrib-qthelp==1.0.6
+    # via sphinx
+sphinxcontrib-serializinghtml==1.1.9
+    # via sphinx
+tox==4.11.3
+    # via -r dev.in
+types-contextvars==2.4.7.3
+    # via -r typing.in
+types-dataclasses==0.6.6
+    # via -r typing.in
+typing-extensions==4.8.0
+    # via mypy
+urllib3==2.0.7
+    # via requests
+virtualenv==20.24.6
     # via
     #   pre-commit
     #   tox
-wheel==0.41.1
+wheel==0.41.3
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file:

requirements/docs.in

@@ -1,5 +1,5 @@
-Pallets-Sphinx-Themes
+pallets-sphinx-themes
-Sphinx
+sphinx
 sphinx-issues
 sphinxcontrib-log-cabinet
 sphinx-tabs

requirements/docs.txt

@@ -1,17 +1,16 @@
-# SHA1:34fd4ca6516e97c7348e6facdd9c4ebb68209d1c
 #
-# This file is autogenerated by pip-compile-multi
+# This file is autogenerated by pip-compile with Python 3.11
-# To update, run:
+# by the following command:
 #
-#    pip-compile-multi
+#    pip-compile docs.in
 #
 alabaster==0.7.13
     # via sphinx
-babel==2.12.1
+babel==2.13.1
     # via sphinx
 certifi==2023.7.22
     # via requests
-charset-normalizer==3.2.0
+charset-normalizer==3.3.2
     # via requests
 docutils==0.18.1
     # via
@@ -25,12 +24,12 @@ jinja2==3.1.2
     # via sphinx
 markupsafe==2.1.3
     # via jinja2
-packaging==23.1
+packaging==23.2
     # via
     #   pallets-sphinx-themes
     #   sphinx
 pallets-sphinx-themes==2.1.1
-    # via -r requirements/docs.in
+    # via -r docs.in
 pygments==2.16.1
     # via
     #   sphinx
@@ -39,9 +38,9 @@ requests==2.31.0
     # via sphinx
 snowballstemmer==2.2.0
     # via sphinx
-sphinx==7.1.2
+sphinx==7.2.6
     # via
-    #   -r requirements/docs.in
+    #   -r docs.in
     #   pallets-sphinx-themes
     #   sphinx-issues
     #   sphinx-tabs
@@ -52,9 +51,9 @@ sphinx==7.1.2
     #   sphinxcontrib-qthelp
     #   sphinxcontrib-serializinghtml
 sphinx-issues==3.0.1
-    # via -r requirements/docs.in
+    # via -r docs.in
-sphinx-tabs==3.4.1
+sphinx-tabs==3.4.4
-    # via -r requirements/docs.in
+    # via -r docs.in
 sphinxcontrib-applehelp==1.0.7
     # via sphinx
 sphinxcontrib-devhelp==1.0.5
@@ -64,10 +63,10 @@ sphinxcontrib-htmlhelp==2.0.4
 sphinxcontrib-jsmath==1.0.1
     # via sphinx
 sphinxcontrib-log-cabinet==1.0.1
-    # via -r requirements/docs.in
+    # via -r docs.in
 sphinxcontrib-qthelp==1.0.6
     # via sphinx
-sphinxcontrib-serializinghtml==1.1.8
+sphinxcontrib-serializinghtml==1.1.9
     # via sphinx
-urllib3==2.0.4
+urllib3==2.0.7
     # via requests

requirements/tests-pallets-min.txt

@@ -1,22 +0,0 @@
-# SHA1:fbb9fae044c2e7d895de9b3d7cbb40a11a822f04
-#
-# This file is autogenerated by pip-compile-multi
-# To update, run:
-#
-#    pip-compile-multi
-#
-blinker==1.6.2
-    # via -r requirements/tests-pallets-min.in
-click==8.1.3
-    # via -r requirements/tests-pallets-min.in
-itsdangerous==2.1.2
-    # via -r requirements/tests-pallets-min.in
-jinja2==3.1.2
-    # via -r requirements/tests-pallets-min.in
-markupsafe==2.1.1
-    # via
-    #   -r requirements/tests-pallets-min.in
-    #   jinja2
-    #   werkzeug
-werkzeug==3.0.0
-    # via -r requirements/tests-pallets-min.in

requirements/tests.txt

@@ -1,19 +1,18 @@
-# SHA1:42d37aff22e2f1fc447e20d483e13d6d4e066b10
 #
-# This file is autogenerated by pip-compile-multi
+# This file is autogenerated by pip-compile with Python 3.11
-# To update, run:
+# by the following command:
 #
-#    pip-compile-multi
+#    pip-compile tests.in
 #
 asgiref==3.7.2
-    # via -r requirements/tests.in
+    # via -r tests.in
 iniconfig==2.0.0
     # via pytest
-packaging==23.1
+packaging==23.2
     # via pytest
-pluggy==1.2.0
+pluggy==1.3.0
     # via pytest
-pytest==7.4.0
+pytest==7.4.3
-    # via -r requirements/tests.in
+    # via -r tests.in
 python-dotenv==1.0.0
-    # via -r requirements/tests.in
+    # via -r tests.in

requirements/typing.txt

@@ -1,23 +1,22 @@
-# SHA1:6a354b832686fd3ec017455769a0270953a1e225
 #
-# This file is autogenerated by pip-compile-multi
+# This file is autogenerated by pip-compile with Python 3.11
-# To update, run:
+# by the following command:
 #
-#    pip-compile-multi
+#    pip-compile typing.in
 #
-cffi==1.15.1
+cffi==1.16.0
     # via cryptography
-cryptography==41.0.3
+cryptography==41.0.5
-    # via -r requirements/typing.in
+    # via -r typing.in
-mypy==1.5.1
+mypy==1.6.1
-    # via -r requirements/typing.in
+    # via -r typing.in
 mypy-extensions==1.0.0
     # via mypy
 pycparser==2.21
     # via cffi
 types-contextvars==2.4.7.3
-    # via -r requirements/typing.in
+    # via -r typing.in
 types-dataclasses==0.6.6
-    # via -r requirements/typing.in
+    # via -r typing.in
-typing-extensions==4.7.1
+typing-extensions==4.8.0
     # via mypy

tox.ini

@@ -17,15 +17,8 @@ constrain_package_deps = true
 use_frozen_constraints = true
 deps =
     -r requirements/tests.txt
-    min: -r requirements/tests-pallets-min.txt
+    min: -r requirements-skip/tests-min.txt
-    dev: https://github.com/pallets/werkzeug/archive/refs/heads/main.tar.gz
+    dev: -r requirements-skip/tests-dev.txt
-    dev: https://github.com/pallets/jinja/archive/refs/heads/main.tar.gz
-    dev: https://github.com/pallets/markupsafe/archive/refs/heads/main.tar.gz
-    dev: https://github.com/pallets/itsdangerous/archive/refs/heads/main.tar.gz
-    dev: https://github.com/pallets/click/archive/refs/heads/main.tar.gz
-#    examples/tutorial[test]
-#    examples/javascript[test]
-# commands = pytest -v --tb=short --basetemp={envtmpdir} {posargs:tests examples}
 commands = pytest -v --tb=short --basetemp={envtmpdir} {posargs:tests}
 
 [testenv:style]