Conversation
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
uv is detected but had no fix implementation: GetCompatiblePackageUpdater had no case for it, so a fix attempt hit the unsupported-technology path. Adds a handleUv method that rewrites the pinned dependency directly in pyproject.toml (wherever it appears - main dependencies, optional extras, or a PEP 735 dependency-groups table) and then runs 'uv lock --upgrade-package' to refresh uv.lock. This mirrors how Renovate fixes uv dependencies today, and avoids needing to know which --group/--optional flag 'uv add' would require, since that information isn't available from the vulnerability evidence. Workspace-owned dependencies aren't targeted: since the handler only ever edits the scanned target's own pyproject.toml, a dependency declared by a workspace member fails safely with the same "impacted package not found" error Pip's handler already returns for an unmatched package, rather than risking editing the wrong file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…elds Three issues from review: - The package name was interpolated into the regex without QuoteMeta or a left boundary, so fixing "attrs" also matched inside "cattrs" and silently bumped the wrong package. - FindString + Replace(..., 1) only fixed the first declaration, so a package listed in both [project].dependencies and a [dependency-groups] table was left half-edited, making the subsequent uv lock fail as unsatisfiable. - No rollback of pyproject.toml when uv lock fails, unlike the other package updaters (npm, pnpm, yarn, go) that all restore the original descriptor on a failed lock/install step. Fixes: - Escape the package name with regexp.QuoteMeta and require a left boundary (start of file, or preceded by whitespace/quote/bracket/ comma) before it, so it can't match as a suffix of another name. - Use ReplaceAllString instead of FindString+Replace(..., 1), so every declaration of the same package gets fixed together. - Roll pyproject.toml back to its original content if uv lock fails, matching the existing convention in npm/pnpm/yarn/go's updaters. - Removed Uv's packageInstallationCommand/packageVersionOperator from techutils.go - unused, since handleUv doesn't go through the generic CLI-add path those fields configure. Added regression tests (TestHandleUvSubstringCollisionSafe, TestHandleUvFixesAllDeclarations) and their testdata fixtures, reproducing both bugs from review before the fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
orto17
force-pushed
the
feature/uv-fix-support
branch
from
September 17, 2026 08:19
42d870d to
a338c59
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
uv is detected but had no fix implementation: GetCompatiblePackageUpdater had no case for it, so a fix attempt hit the unsupported-technology path.
Adds a handleUv method that rewrites the pinned dependency directly in pyproject.toml (wherever it appears - main dependencies, optional extras, or a PEP 735 dependency-groups table) and then runs 'uv lock --upgrade-package' to refresh uv.lock. This mirrors how Renovate fixes uv dependencies today, and avoids needing to know which --group/--optional flag 'uv add' would require, since that information isn't available from the vulnerability evidence.
Workspace-owned dependencies aren't targeted: since the handler only ever edits the scanned target's own pyproject.toml, a dependency declared by a workspace member fails safely with the same "impacted package not found" error Pip's handler already returns for an unmatched package, rather than risking editing the wrong file.
devbranch.go vet ./....go fmt ./....