diff --git a/README.md b/README.md index 516fa69..105878b 100644 --- a/README.md +++ b/README.md @@ -49,6 +49,22 @@ which some project owners may want to configure differently. package is compromised, delaying makes it more likely that the compromised version will be detected and pulled from the repository before we try to upgrade. This should not affect security vulnerability alerts. + - If your project uses Poetry, you should also configure Poetry's `solver.min-release-age` setting and + `solver.min-release-age-exclude` settings: + ```toml + # poetry.toml + [solver] + # Set min-release-age to 2 weeks, same as in https://github.com/ni/python-renovate-config + min-release-age = 14 + min-release-age-exclude = ["ni-python-styleguide"] + ``` + Without this configuration, Renovate may display an "Artifact update problem" because `poetry update` updated + a dependency to a newer version than Renovate was expecting. + + You should also rerun `poetry lock` with Poetry 2.4.x or later and make sure the comment at the top of `poetry.lock` + says "# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand." Renovate uses this + comment to decide which version of Poetry to run. If Renovate uses Poetry 2.3.x or earlier, the `solver.min-release-age` + setting is ignored. ## Presets