chore(deps): bump uv from 0.11.29 to 0.11.32 across every release input - #27
Merged
Conversation
Dependabot's #22 changed only the `release` extra, so `uv sync --locked` rejected the stale uv.lock and every CI leg failed. Complete the bump instead: the `release` extra, the semantic-release build_command, its contract test, and the regenerated lock all move together. Adds a guard that the two pyproject uv pins agree. Only the `release` extra is reflected in uv.lock, so a half-applied bump would otherwise let the release build install a uv that is neither declared nor locked. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes #22, which could not go green.
Dependabot bumped only
[project.optional-dependencies].release. The lockfile was left at 0.11.29, so the very first CI step failed on every leg:The uv pin is declared in three places, and a correct bump has to move all of them plus the lock:
pyproject.toml[project.optional-dependencies].releaseuv.lockpyproject.toml[tool.semantic_release].build_commandtests/test_release_contract.pyuv.lockuventry +requires-distspecifierThe lock diff is contained to the
uvpackage entry and its specifier; no other resolution changed.Also adds
test_release_uv_pin_is_declared_once. Only thereleaseextra reachesuv.lock, so if a future bump touches one pyproject pin and not the other, the release build would install a uv that is neither declared nor locked and nothing would notice. Verified the guard fails when the pins diverge, not just that it passes.Locally against uv 0.11.32:
uv lock --locked,uv sync --locked --extra dev,ruff check, and 144 passed / 2 skipped.