fix(build): pin locked dependency versions in installers#185
Merged
Conversation
The install scripts used `uv tool install` without a lockfile, so they re-resolved dependencies to the newest versions allowed by pyproject. That drifts from the tested set: once litellm 1.92+ shipped a Rust extension with Linux-only wheels, Windows/macOS installs broke because the source build needs a compiler (link.exe / a Rust toolchain). Export the locked constraints at release time (`uv export --locked`, attached as raven-constraints.txt) and pass them to `uv tool install -c` in install.sh, install.ps1, and the `raven upgrade` self-upgrade helper. The constraints URL is derived from the wheel URL so it always matches the wheel being installed, including the RAVEN_WHEEL_URL escape hatch. A missing asset or a failed download degrades to an unconstrained install rather than aborting. Nothing in pyproject changes: uv lock still governs when litellm upgrades; the pin only applies to distribution. Co-authored-by: Claude (claude-opus-4-8) <noreply@anthropic.com>
Co-authored-by: Claude (claude-opus-4-8) <noreply@anthropic.com>
0xKT
requested review from
TongLi31,
alwaysday1,
arelchan,
chuanruihu and
cyfyifanchen
and removed request for
TongLi31,
chuanruihu and
cyfyifanchen
July 22, 2026 14:05
alwaysday1
approved these changes
Jul 22, 2026
chuanruihu
approved these changes
Jul 22, 2026
0xKT
added a commit
that referenced
this pull request
Jul 22, 2026
## Summary Bump version from 0.1.7 to 0.1.8. Release commit only touches `pyproject.toml` and `uv.lock` (kept in sync via `uv lock`). Changes bundled into this release since v0.1.7: - feat(importer): cold-start import from other AI tools with EverOS HTTP backend (#170) - fix(build): pin locked dependency versions in installers (#185) - fix(cli): stop blank api key exiting deep_research prompt (#184) - fix: use redirect-free install.ps1 url on windows powershell 5.1 (#182) - fix(tui): brighten selection highlight for readability (#175) - fix(commitlint): align subject-case with conventional-commits standard (#187) ## Type - [x] Other ## Verification - [x] Relevant lint / type checks pass locally ``` python3 scripts/check_commit_messages.py origin/main..HEAD # exit 0 git diff --stat # pyproject.toml + uv.lock, 1 line each ``` ## Risk - [x] Backward compatibility considered Version bump only; no source changes. ## Related Issues N/A Co-authored-by: Claude (claude-opus-4-8) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change description
The one-click installers ran
uv tool installwithout a lockfile, so theyre-resolved dependencies to the newest versions allowed by
pyproject.tomlinstead of the tested set. Once
litellm1.92+ shipped a Rust extension withLinux-only wheels, Windows/macOS installs broke: with no wheel, the sdist builds
from source and needs a compiler (
link.exe/ a Rust toolchain).Fix, without touching the
pyproject.tomlconstraints (souv lockstillgoverns when litellm upgrades):
raven-constraints.txtrelease asset via
uv export --locked --all-extras --no-hashes.--lockedfails the release if
uv.lockis stale vspyproject.toml, so we never shipconstraints that conflict with the wheel's own metadata.
uv tool install -c.The constraints URL is derived from the wheel URL (same release directory) so
it always matches the wheel being installed, including the
RAVEN_WHEEL_URLescape hatch. A missing asset or a failed download degrades to an
unconstrained install rather than aborting.
upgrade_commands.py): the self-upgrade helper does thesame derive-and-pin, so upgrading an installed copy no longer re-triggers the
litellm source build either.
With the pin, litellm resolves to the locked 1.85.0 (pure-Python, wheels on all
platforms), so no compiler is needed anywhere.
Rollout note: this only takes effect once a new release is cut (so the
raven-constraints.txtasset exists). Existing releases have no such asset andthe scripts degrade to the current unconstrained behavior. Recommend cutting an
rc first and verifying a zero-compile install on real Windows and macOS before
the stable tag.
Type of change
Related issues
Closes #181
Checklists
Development
Security
Code review