[ANE-2886] Handle missing version field in uv.lock editable packages#1682
Open
[ANE-2886] Handle missing version field in uv.lock editable packages#1682
Conversation
The uv lockfile format allows packages to omit the version field when they are source trees with dynamic versions. Our parser treated version as required, causing a fatal parse error that dropped all dependencies from the file. Make version optional and filter out versionless packages during graph construction. These are always the users own project, never third-party deps, so they carry no license implications and were already removed by shrinkRoots. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
WalkthroughThe changes address parsing of 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
The previous approach filtered out versionless packages before graph construction, which removed the root package too early and broke the edge structure. The root package holds the prod/dev dependency lists needed by markRootEnvs. Instead, include all packages in the graph and let shrinkRoots naturally remove the versionless root after the graph is properly built. Also fixes fourmolu formatting (then/else indentation). Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
In uv-editable.lock, anyio and idna are only reachable via httpx (prod), so they should have [EnvProduction] only — unlike the main uv.lock test where starlette (dev) also reaches anyio. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Member
Author
|
@coderabbitai help |
Contributor
ChatThere are 3 ways to chat with CodeRabbit:
CodeRabbit commands
Other keywords and placeholders
Status, support, documentation and community
|
Member
Author
|
@coderabbitai full review |
Contributor
✅ Actions performedFull review triggered. |
csasarak
approved these changes
Apr 3, 2026
Contributor
csasarak
left a comment
csasarak
left a comment
There was a problem hiding this comment.
LG, I'd add some explanation around what an editable package actually is.
Instead of relying solely on shrinkRoots to remove workspace packages, explicitly parse the source field for editable/virtual keys and filter them from the final graph using shrink (which rewires edges through removed nodes to preserve transitivity). This correctly handles workspace members that are not graph roots (e.g., a workspace member depended on by the root project) which would previously survive shrinkRoots. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
The url field was parsed but never read anywhere. Only editable and virtual are needed for workspace package detection. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
A package source is always exactly one of: editable, virtual, registry, git, url, or path. A sum type makes this invariant unrepresentable to violate — no more Maybe fields that could theoretically all be Nothing or multiple be Just simultaneously. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Map UvLockPackageSource variants to the appropriate DepType: - SourceGit -> GitType (URL as name, commit hash as version) - SourcePath -> UnresolvedPathType (path as name) - SourceUrl -> URLType (URL as name) - SourceRegistry -> PipType (package name, unchanged) Git URLs in uv.lock encode the commit hash as a URL fragment (e.g., https://github.com/owner/repo?tag=v1#abc123), which is extracted as the version. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR fixes a parse error when FOSSA CLI encounters a uv.lock file containing editable/workspace packages with dynamic versions. The uv lockfile spec allows omitting the
versionfield on source tree packages (editable, directory, virtual) that declaredynamic = ["version"]in their pyproject.toml. Our parser treatedversionas required, causing the file parse to fail and drop all dependencies.This PR makes
versionoptional in the parser and filters out versionless packages during graph construction.Acceptance criteria
When users scan a project that has a uv.lock file containing editable/workspace packages without a version field, the CLI should successfully parse the lockfile and report all third-party dependencies instead of failing with:
Testing plan
should skip editable packages without a versionthat constructs aUvLockwith aNothingversion on the root package and verifies the graph is built correctly with only the versioned dependencies.correctly parse uv.lock with editable package missing versionwith a new test fixture (test/Python/testdata/uv-editable.lock) that contains a[[package]]entry withsource = { editable = "." }and no version field.Maybe Textversion field.Risks
Minimal. The change is surgical:
reqKey "version"\ ->optKey "version"` in the TOML parserText->Maybe Textfor the version fieldshrinkRootsReferences
versionisOption<Version>:crates/uv-resolver/src/lock/mod.rsChecklist
docs/.docs/README.msand gave consideration to how discoverable or not my documentation is.Changelog.md. If this PR did not mark a release, I added my changes into an## Unreleasedsection at the top..fossa.ymlorfossa-deps.{json.yml}, I updateddocs/references/files/*.schema.jsonAND I have updated example files used byfossa initcommand. You may also need to update these if you have added/removed new dependency type (e.g.pip) or analysis target type (e.g.poetry).docs/references/subcommands/<subcommand>.md.