Harden uv lockfile patch preservation and verify every uv release family - #239

Merged

Mikola Lysenko (mikolalysenko) merged 25 commits into

mainfrom

fix/uv-followups

Sep 16, 2026

Commits on Sep 15, 2026

Harden uv lockfile patch preservation after #238

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
bcf290b
Follow each uv `[[distribution]]` lock shape when redirecting

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
af9c79b
Vendor into uv 0.2.35/0.2.36 locks that predate [package.metadata]

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
310b904
Record the 41-release uv compatibility matrix for source 310b904

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
3726770
utils/fs: export read_regular_to_string and is_symlink helpers

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
1e5a62a
uv vendor: classify [tool.uv] dev-dependencies as direct; repoint every metadata entry

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
da2f188
uv vendor: advise that override-dependencies wiring needs uv >= 0.5.6

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
8ffe535
uv: repoint [manifest] constraints / build-constraints for the redirected package

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
01326eb
uv vendor: keep a CRLF pyproject.toml / uv.lock pair CRLF through wire and revert

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
a7579ce
uv: say what a [[distribution]] lock actually cannot do instead of "records absolute paths"

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
433af3f
uv vendor: gate the metadata no-op on the sub-tables too, not the bare header

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
34cea6a
uv vendor: refuse a symlinked pyproject.toml / uv.lock before any write

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
fb5b584
vendor/pypi: fail-closed listing, include probing and orphan reclaim for the unwired-revert guard

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
a543899
repair/vendor: FIFO-safe reference scan that also sees `-r` include pins

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
94693ed
python_lock: fix uv version boundaries in comments; pin ≤0.2.5 sdist and sibling-shape rewrites

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
91e6794
lock_inventory: document that uv.lock exclusivity is keyed on parse success; pin poetry/script union and corrupt-uv.lock fall-through

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
82e3385
python_script: scope the SourcesLayout revert claim to direct deps; pin where toml_edit places [tool.uv.sources]

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
8e9af22
pypi_lock: read symlinked locks like their targets, refuse to write through them

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
1f3c87b
hosted: refuse symlinked rewrite targets before the ledger; FIFO-safe candidate reads

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
b5d49ad
backtest-uv: variant lane, stdout export, and a doc-table renderer

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
45258f6
docs: correct the uv boundaries and describe the #239 hardening

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
f03e623
uv: count [tool.uv] dev-dependencies as direct for hosted sources; bracket the uv lock boundary

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
17d0dcb
uv vendor: advise that the [manifest] constraints repoint needs uv >= 0.5.6

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
f5edb14
Record the 42-release uv compatibility matrix for source 17d0dcb

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
18d4046
utils/fs: accept Windows' PermissionDenied for a directory in the sync-reader test

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
f81cb2e

Navigation Menu

Harden uv lockfile patch preservation and verify every uv release family - #239

Harden uv lockfile patch preservation and verify every uv release family#239
Mikola Lysenko (mikolalysenko) merged 25 commits into
mainfrom
fix/uv-followups

Commits on Sep 15, 2026

Harden uv lockfile patch preservation after #238

Follow each uv `[[distribution]]` lock shape when redirecting

Vendor into uv 0.2.35/0.2.36 locks that predate [package.metadata]

Record the 41-release uv compatibility matrix for source 310b904

utils/fs: export read_regular_to_string and is_symlink helpers

uv vendor: classify [tool.uv] dev-dependencies as direct; repoint every metadata entry

uv vendor: advise that override-dependencies wiring needs uv >= 0.5.6

uv: repoint [manifest] constraints / build-constraints for the redirected package

uv vendor: keep a CRLF pyproject.toml / uv.lock pair CRLF through wire and revert

uv: say what a [[distribution]] lock actually cannot do instead of "records absolute paths"

uv vendor: gate the metadata no-op on the sub-tables too, not the bare header

uv vendor: refuse a symlinked pyproject.toml / uv.lock before any write

vendor/pypi: fail-closed listing, include probing and orphan reclaim for the unwired-revert guard

repair/vendor: FIFO-safe reference scan that also sees `-r` include pins

python_lock: fix uv version boundaries in comments; pin ≤0.2.5 sdist and sibling-shape rewrites

lock_inventory: document that uv.lock exclusivity is keyed on parse success; pin poetry/script union and corrupt-uv.lock fall-through

python_script: scope the SourcesLayout revert claim to direct deps; pin where toml_edit places [tool.uv.sources]

pypi_lock: read symlinked locks like their targets, refuse to write through them

hosted: refuse symlinked rewrite targets before the ledger; FIFO-safe candidate reads

backtest-uv: variant lane, stdout export, and a doc-table renderer

docs: correct the uv boundaries and describe the #239 hardening

uv: count [tool.uv] dev-dependencies as direct for hosted sources; bracket the uv lock boundary

uv vendor: advise that the [manifest] constraints repoint needs uv >= 0.5.6

Record the 42-release uv compatibility matrix for source 17d0dcb

utils/fs: accept Windows' PermissionDenied for a directory in the sync-reader test