Skip to content

fix(lock): key lockfile packages by their PEP 503 name - #262

Draft
schloerke wants to merge 3 commits into
mainfrom
schloerke/233-canonical-lock-names
Draft

schloerke wants to merge 3 commits into
mainfrom
schloerke/233-canonical-lock-names

Conversation

@schloerke

@schloerke schloerke commented Nov 2, 2026 •

Copy link
Copy Markdown
Collaborator

Fixes posit-dev/shinylive#233.

A full lockfile regen (make update_packages_lock) wrote each dependency under the name its parent used. ipywidgets 8.1.8 spells its dependency jupyterlab_widgets, but Pyodide looks packages up by their canonical name (jupyterlab-widgets), so apps that use shinywidgets failed with No known package with name 'jupyterlab_widgets'.

scripts/pyodide_packages.py now uses packaging.utils.canonicalize_name for:

  • the keys it writes to shinylive_lock.json
  • the "is this already in Pyodide or in our lock?" check, which used to only lowercase names
  • the AVOID_DEPEND_PACKAGES check, so a package that spells its name differently is still dropped

A package's import name now comes from the name PyPI reports, not from the lookup key. Built from the canonical key, ruamel.yaml would have become ruamel_yaml. Every package in the current lock gets the same import names as before.

Wheel filenames and URLs are unchanged; only the lookup keys are canonical.

This PR changes only the script. posit-dev/shinylive#263, stacked on top, regenerates the lock with it.

@schloerke
schloerke added this pull request to stack #264 November 2, 2026 18:45
@schloerke schloerke changed the title schloerke/233 canonical lock names fix(lock): key lockfile packages by their PEP 503 name Nov 2, 2026
@github-actions

github-actions Bot commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Unit tests only — the pure-logic modules in src/. The React components, hooks, engine proxies and service worker are covered by the pytest + Playwright suites in tests/, which are not measured here.

Coverage report

St.❔
Category Percentage Covered / Total
🟢 Statements 100% 1994/1994
🟢 Branches 100% 400/400
🟢 Functions 100% 96/96
🟢 Lines 100% 1994/1994

Test suite run success

342 tests passing in 20 suites.

Report generated by 🧪jest coverage report action from 4abb10e

A dependency spelled `jupyterlab_widgets` was written to the lockfile
under that key, but Pyodide looks packages up by their canonical name
(`jupyterlab-widgets`), so the app failed to load it. Canonicalize names
where they become lockfile keys and in the "already in Pyodide" check.

Fixes #233
@schloerke
schloerke force-pushed the schloerke/233-canonical-lock-names branch from 9706867 to 8b6fb44 Compare November 10, 2026 03:38
…d packages by PEP 503 name

A dependency is now keyed by its PEP 503 name, so building its import name from that key would turn ruamel.yaml into ruamel_yaml. Use the name PyPI reports instead. AVOID_DEPEND_PACKAGES is checked against the PEP 503 name, so a package that spells its name differently is still dropped.
@schloerke
schloerke marked this pull request as ready for review November 10, 2026 19:06
@schloerke
schloerke marked this pull request as draft November 10, 2026 19:06

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Full lockfile regen is broken: dependency names are not PEP 503 canonicalized

1 participant