`uv lock` not working as expected in some cases when `upgrade_package` is set

[cscanlin]

Summary

I had a very hard time coming up with a minimum example, and I can't share my entire pyproject.toml or uv.lock, but I hope this helps. I'm having an issue when I run uv lock and then subsequently run uv sync --locked, I get the error that my lock file is out of date. Here's an approximate reconstruction:

$ uv add opencv-python==4.10.0.82
Resolved 269 packages in 1.07s
Installed 1 package in 646ms
Bytecode compiled 27180 files in 664ms
 + opencv-python==4.10.0.82
$ uv sync
Resolved 269 packages in 301ms
Bytecode compiled 27180 files in 562ms
$ uv sync --locked
Resolved 269 packages in 175ms
The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.
$ uv remove opencv-python
Resolved 268 packages in 1.21s
Uninstalled 1 package in 30ms
Bytecode compiled 27167 files in 604ms
 - opencv-python==4.10.0.82
$ uv sync
Resolved 268 packages in 215ms
Bytecode compiled 27167 files in 523ms
$ uv sync --locked
Resolved 268 packages in 200ms
The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.
$ git diff uv.lock
diff --git a/uv.lock b/uv.lock
index 1ba71cd237..152f1298c2 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,6 +1,11 @@
 version = 1
 revision = 3
 requires-python = "==3.11.*"
+resolution-markers = [
+    "sys_platform == 'darwin'",
+    "platform_machine == 'aarch64' and sys_platform == 'linux'",
+    "(platform_machine != 'aarch64' and sys_platform == 'linux') or (sys_platform != 'darwin' and sys_platform != 'linux')",
+]

 [[package]]
 name = "alembic"
@@ -1656,7 +1661,7 @@ dependencies = [
     { name = "overrides" },
     { name = "packaging" },
     { name = "prometheus-client" },
-    { name = "pywinpty", marker = "os_name == 'nt'" },
+    { name = "pywinpty", marker = "(os_name == 'nt' and platform_machine != 'aarch64' and sys_platform == 'linux') or (os_name == 'nt' and sys_platform != 'darwin' and sys_platform != 'linux')" },
     { name = "pyzmq" },
     { name = "send2trash" },
     { name = "terminado" },
@@ -1674,7 +1679,7 @@ name = "jupyter-server-terminals"
 version = "0.5.4"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "pywinpty", marker = "os_name == 'nt'" },
+    { name = "pywinpty", marker = "(os_name == 'nt' and platform_machine != 'aarch64' and sys_platform == 'linux') or (os_name == 'nt' and sys_platform != 'darwin' and sys_platform != 'linux')" },
     { name = "terminado" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/f4/a7/bcd0a9b0cbba88986fe944aaaf91bfda603e5a50bda8ed15123f381a3b2f/jupyter_server_terminals-0.5.4.tar.gz", hash = "sha256:bbda128ed41d0be9020349f9f1f2a4ab9952a73ed5f5ac9f1419794761fb87f5", size = 31770, upload-time = "2026-01-14T16:53:20.213Z" }
@@ -3424,7 +3429,7 @@ version = "0.18.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "ptyprocess", marker = "os_name != 'nt'" },
-    { name = "pywinpty", marker = "os_name == 'nt'" },
+    { name = "pywinpty", marker = "(os_name == 'nt' and platform_machine != 'aarch64' and sys_platform == 'linux') or (os_name == 'nt' and sys_platform != 'darwin' and sys_platform != 'linux')" },
     { name = "tornado" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/8a/11/965c6fd8e5cc254f1fe142d547387da17a8ebfd75a3455f637c663fb38a0/terminado-0.18.1.tar.gz", hash = "sha256:de09f2c4b85de4765f7714688fff57d3e75bad1f909b589fde880460c753fd2e", size = 32701, upload-time = "2024-03-12T14:34:39.026Z" }
@@ -3551,7 +3556,7 @@ version = "0.32.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "attrs" },
-    { name = "cffi", marker = "implementation_name != 'pypy' and os_name == 'nt'" },
+    { name = "cffi", marker = "(implementation_name != 'pypy' and os_name == 'nt' and platform_machine != 'aarch64' and sys_platform == 'linux') or (implementation_name != 'pypy' and os_name == 'nt' and sys_platform != 'darwin' and sys_platform != 'linux')" },
     { name = "idna" },
     { name = "outcome" },
     { name = "sniffio" },
$ rm uv.lock
$ uv sync
    Updated ssh://git@bitbucket.org/kwh/minimart.git (a168ca9fd1e689552b69b815d2b1934909f4d1c7)
Resolved 268 packages in 1.55s
Bytecode compiled 27167 files in 735ms
$ git diff uv.lock
$ uv sync --locked
Resolved 268 packages in 310ms
Bytecode compiled 27167 files in 573ms

The issue only seems to occur when opencv-python is added. So far I have only been able to reproduce this with our full set of dependencies, opencv along with a significant subset of ours still works, so I'm having trouble coming up with a reproduction.

Notably, I am also running this in docker on mac, but I am also able to reproduce this outside of my docker container.

This issue also only occurs when upgrade_package is set (does not seem to matter what package). It doesn't happen when I comment that line out.

Please let me know if I can provide more details

Platform

Darwin 23.4.0 arm64, Linux 6.10.14-linuxkit aarch64 GNU/Linux (docker container)

Version

uv 0.9.26

Python version

Python 3.11.2

[zanieb]

Would you mind testing one of the development builds attached to CI in #17752 and see if it resolves your problem?

[cscanlin]

Awesome, that seems to fix it, thank you!

[zanieb]

Unfortunately the issue is quite hairy, I can't ship that fix as-is but we'll look into it. Thanks for confirming!