Summary

Hi all,

A container is failing to start because uv tries to reinstall the deps, specifically for private packages. And I don't pass in private repo tokens to the container runtime env vars because those shouldn't be needed. My project's Docker setup is such that if deps or the lock file changes, a new image should be built (and the tokens are provided as secrets during the build).

It turns out uv considers the lock file invalid. I see this when I run 'uv -v tree' with the image:

DEBUG Ignoring existing lockfile due to mismatched requirements for: my-obfuscated-project==0.1.0

The debug logs after that include the requested and existing dependencies. I copied each, formatted, and did a diff. These are the only lines that differ (red is from 'requested' and green is from 'existing'):

    }, Requirement { name: PackageName("my-private-package"), extras: [], groups: [], marker: true, source: Registry { specifier: VersionSpecifiers([VersionSpecifier { operator: EqualStar, version: "1"
                }
-           ]), index: Some(IndexMetadata { url: Url(VerbatimUrl { url: DisplaySafeUrl { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("my-aws-project.d.codeartifact.us-east-1.amazonaws.com")), port: None, path: "/pypi/pypi/simple/", query: None, fragment: None
+           ]), index: Some(IndexMetadata { url: Url(VerbatimUrl { url: DisplaySafeUrl { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("my-aws-project.d.codeartifact.us-east-1.amazonaws.com")), port: None, path: "/pypi/pypi/simple", query: None, fragment: None
                    }, given: None
                }), format: Simple
            }), conflict: None
        }, origin: None
    },

Specifically:

- path: "/pypi/pypi/simple/"
+ path: "/pypi/pypi/simple"

It seems like something in uv is adding a trailing slash and considering that to be enough to invalidate the entire lock file and venv. While it makes sense to compare the lock file, a change like this is trivial and should be ignored. Ideally the trailing slash wouldn't be added at all and the lock file remains consistent across uv versions, but minor deltas like this will always happen (even if uv were to hit 1.x and consider itself 'stable').

I have a uv.lock file generated from 0.7.14.
In the Docker image, uv is at 0.7.16.
I tested 0.7.14 and 0.7.15 in the Docker image and they work fine, so the regression happened in 0.7.16.

Platform

macOS Sequoia 15.5 (Darwin 24.5.0 arm64)

Version

0.7.14 and 0.7.16

Python version

3.10.18