Skip to content

build: synchronize uv lockfile - #113

Open
andife wants to merge 1 commit into
GenAI-Security-Project:mainfrom
andife:fix/synchronize-uv-lockfile
Open

andife wants to merge 1 commit into
GenAI-Security-Project:mainfrom
andife:fix/synchronize-uv-lockfile

Conversation

@andife

@andife andife commented Oct 18, 2026

Copy link
Copy Markdown

Summary: Add the declared aiofiles runtime dependency to uv.lock and refresh resolver markers generated by the current uv version. Testing: uv lock --check passes.

@drk-ram drk-ram left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed head 37b9a65b3bb3e6e07bff2ef064989703fb35bc64.

Approving. The lock now contains the runtime dependency pyproject.toml already declares, and the refresh checks out.

aiofiles>=23.2.1 is in [project].dependencies. This head adds aiofiles 25.1.0 to uv.lock, including the project dependencies and requires-dist entries. I checked the published 25.1.0 artifacts: wheel abe311e527c862958650f9438e859c1fa7568a141b22abcd015e120e86a85695 and sdist a8d728f0a29de45dc521f18f07297428d56992a742f0cd2701ba86e44d23d5b2. Both match the lock. 25.1.0 satisfies >=23.2.1.

The other hunks are resolver markers on the CUDA / NVIDIA packages (sys_platform != 'win32', and sys_platform == 'linux' on the cuda-bindings optional extras). That is a metadata refresh, not a dropped Linux dependency and not a silent removal of aiofiles. I ran uv lock --check on this head with uv 0.13.5: it resolved 122 packages and exited 0. Hosted Actions did not report a check run here either, so the local lock check is the validation I am relying on.

I did not treat this as a vulnerability bump or a runtime behavior change. No Python source moves. If a later uv rewrite changes markers again, that belongs in its own lock refresh rather than being folded back into this one.

No change requested.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants