build: pin an absolute exclude-newer so CI can verify the lockfile - #12
Merged
Conversation
A relative exclude-newer (the maintainer's global "7 days") stamps a machine-specific exclude-newer-span into uv.lock, which CI cannot reproduce, so --locked could never be satisfied. Pinning an absolute date makes the lock machine-independent and restores lockfile verification across every CI leg. polars 1.43.0 and 1.43.1 are yanked and the fix (1.43.2) postdates the pin, so polars is exempted per-package rather than leaving the project on a yanked release.
A bare date resolves to local midnight, so the lock recorded 2026-07-26T07:00:00Z on a PDT machine while CI computed 2026-07-26T00:00:00Z — the same class of machine-dependence the absolute pin was meant to remove.
uv merges the maintainer's global exclude-newer-package into the lockfile, so the project must declare the same entries or CI computes a different set and --locked fails.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restores
uv sync --lockedacross every CI leg, and fixes a yanked dependency found on the way.The problem
The maintainer's global
~/.config/uv/uv.tomlsetsexclude-newer = "7 days"— a relativeconstraint. uv stamps it into
uv.lockasexclude-newer-span = "P7D", which CI cannotreproduce, so
--lockedfailed deterministically and had to be removed. Lockfile verificationwas off as a result.
The fix
Pin an absolute date in
pyproject.toml:The lock now records an absolute
exclude-newer = "2026-07-26T07:00:00Z"and contains noexclude-newer-span, so it is machine-independent and--lockedworks everywhere.The yanked dependency this surfaced
The project was on a yanked polars. The fix postdates the pin, so polars is exempted
per-package rather than freezing on a yanked release:
Everything else keeps the supply-chain guard.
Verified
uv sync --lockedexclude-newer-spanin lockThe CI audit test previously asserted
--lockedwas absent; it now asserts it is present,with a comment on why reverting to a relative exclude-newer would break it again.
🤖 Generated with Claude Code
https://claude.ai/code/session_01SjSyr1rQx2gnGTdw9Ncj6h