Support upload-time from Simple Repository API (PEP 700) for release timestamps

[thejoeejoee]

Problem

When Renovate resolves Python packages from registries that only expose the Simple Repository API (e.g. Artifactory, devpi, custom mirrors), releaseTimestamp is not populated — minimumReleaseAge and related features don't work.

This is because getSimpleDependency() currently only parses the HTML response, which has no timestamp data. The releaseTimestampNote explicitly says: "This field is not available when using the simple API."

Users with private registries have reported this gap before (see #20070, #24829).

Proposed change

PEP 700 (accepted, API version 1.1) added an upload-time field to the JSON serialization of the Simple Repository API (spec). PyPI.org and compliant registries already serve this data.

The implementation would:

1. Send a PEP 691 Accept header requesting the JSON format (application/vnd.pypi.simple.v1+json) when calling the Simple API
2. If the server responds with JSON, parse upload-time from each file and derive releaseTimestamp per version
3. If the server responds with HTML (doesn't support JSON), fall back to the existing HTML parser — no behavior change

This is fully backward-compatible: servers that don't support JSON content negotiation will continue to work exactly as they do today.

Who benefits

• Users with private Simple API registries (Artifactory, devpi, Nexus) that support PEP 691/700 — they get minimumReleaseAge support
• The existing PyPI.org JSON API path (/pypi/<pkg>/json) is unaffected — it already provides timestamps via a different mechanism

Implementation

I have a working implementation ready as a PR. It modifies only getSimpleDependency() in lib/modules/datasource/pypi/index.ts — the JSON API path (getDependency()) and URL routing in getReleases() are untouched.

[aniruddhaadak80]

Adding PEP 700 upload-time support would greatly improve Renovate's mergeConfidence delays for Python packages! Parsing the PyPI simple JSON response directly rather than falling back to the legacy XMLRPC endpoint will definitively solve the timestamp discrepancy issues for pip artifacts.

[thejoeejoee]

This is a feature request for adding PEP 700 upload-time support to the Simple API path, not a bug report. There's nothing to reproduce or debug here.

what, XMLRPC? 😄