Block prereleases, refresh the lock - #79
Merged
Merged
Conversation
python-commerce carries prerelease = "disallow" and the rest of the fleet did not, which is backwards: the registry entry that added it says to check the whole fleet rather than the repo in front of you, because the shape it guards against is an unbounded transitive requirement, not a particular package. An unbounded requirement lets a routine refresh resolve a beta and drag a subtree with it, and the suite passes either way, so nothing reports it. That is how python-commerce once resolved web3 8.0.0b3 through three unbounded parents. Every uv.lock in the workspace was swept for a/b/rc versions first: all five are clean today, so this is a guard against the next refresh rather than a fix. Lock refresh takes lefthook 2.1.11. No version bump: the changes are dev-only and reach no consumer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
prerelease = "disallow"under[tool.uv]and refreshes the lock (lefthook 2.1.11).python-commerce has carried this guard since the sweep that added it; the rest of the fleet did not, which is backwards. The registry entry behind it says to check the whole fleet rather than the repo in front of you, because what it guards against is an unbounded transitive requirement rather than a particular package: an unbounded requirement lets a routine refresh resolve a beta and drag a subtree with it, and the suite passes either way, so nothing reports it. That is how python-commerce once resolved
web38.0.0b3 through three unbounded parents.Every
uv.lockin the workspace was swept fora/b/rcversions before writing this, enumerated withfindrather than from memory since core holds three Python projects the JS tooling cannot see. All five are clean today, so this is a guard against the next refresh, not a fix for a live problem. The same guard is going into core's three projects in that repo's own PR.Type of change
Public API
None. No exported symbol, signature, or wire format changed.
No version bump, deliberately. The runbook releases only where a consumer must act, and a lockfile plus a resolver setting reaches nobody: the published wheel ships neither.
Test plan
Full gate set locally:
ruff check,ruff format --check,ty check,vulture(run the way CI runs it, with the whitelist argument), andpytest(183 passed, 8 skipped, 100% coverage against a 95% floor). Exit codes read directly rather than off the tail of a pipe.Checklist