uv pip compile always upgrades already pinned vcs dependencies #18224
Description
Summary
I'm toying with pylock.toml these days, and I noticed the following problem with vcs dependencies while looking at replacing my pip-deepfreeze requirements.txt workflow with pylock.toml.
Assume the following pyproject.toml with one regular dependency and one vcs dependency:
[project]
name = "test"
version = "1.0"
dependencies = ["pip-test-package", "packaging"]
[tool.uv.sources]
pip-test-package = { git = "https://github.com/pypa/pip-test-package"}and the following pylock.toml where non-current versions are pinned:
# This file was autogenerated by uv via the following command:
# uv pip compile pyproject.toml -o pylock.toml
lock-version = "1.0"
created-by = "uv"
requires-python = ">=3.14"
[[packages]]
name = "packaging"
version = "24.2"
sdist = { url = "https://files.pythonhosted.org/packages/d0/63/68dbb6eb2de9cb10ee4c9c14a0148804425e13c4fb20d61cce69f53106da/packaging-24.2.tar.gz", upload-time = 2024-11-08T09:47:47Z, size = 163950, hashes = { sha256 = "c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f" } }
wheels = [{ url = "https://files.pythonhosted.org/packages/88/ef/eb23f262cca3c0c4eb7ab1933c3b1f03d021f2c48f54763065b6f0e321be/packaging-24.2-py3-none-any.whl", upload-time = 2024-11-08T09:47:44Z, size = 65451, hashes = { sha256 = "09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759" } }]
[[packages]]
name = "pip-test-package"
version = "0.1"
vcs = { type = "git", url = "https://github.com/pypa/pip-test-package", commit-id = "a8992fc7ee17e5b9ece022417b64594423caca7c" }Notice the above pylock.toml has an oldest version of packaging and a commit-id for pip-test-package that is not the tip of its master branch.
Now run uv pip compile pyproject.toml -o pylock.toml. It produces the following pylock.toml:
# This file was autogenerated by uv via the following command:
# uv pip compile pyproject.toml -o pylock.toml
lock-version = "1.0"
created-by = "uv"
requires-python = ">=3.14"
[[packages]]
name = "packaging"
version = "24.2"
sdist = { url = "https://files.pythonhosted.org/packages/d0/63/68dbb6eb2de9cb10ee4c9c14a0148804425e13c4fb20d61cce69f53106da/packaging-24.2.tar.gz", upload-time = 2024-11-08T09:47:47Z, size = 163950, hashes = { sha256 = "c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f" } }
wheels = [{ url = "https://files.pythonhosted.org/packages/88/ef/eb23f262cca3c0c4eb7ab1933c3b1f03d021f2c48f54763065b6f0e321be/packaging-24.2-py3-none-any.whl", upload-time = 2024-11-08T09:47:44Z, size = 65451, hashes = { sha256 = "09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759" } }]
[[packages]]
name = "pip-test-package"
version = "0.1.1"
vcs = { type = "git", url = "https://github.com/pypa/pip-test-package", commit-id = "96d6d72ac54132aecbdd5adac88bc8d1f8fb986b" }Notice that the packaging dependency is correctly unchanged, but the pip-test-package dependency has been updated to the tip of its master branch, which is not what we expect from the documentation which states:
When using an output file, uv will consider the versions pinned in an existing output file. If a dependency is pinned it will not be upgraded on a subsequent compile run.
A similar behavior is observed when using requirements.txt instead of pylock.toml.
Platform
linux
Version
0.10.7
Python version
No response