Servers with pyproject.toml should also have a corresponding uv.lock
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 349
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 318
Description
For example, the VLLM responses API model server has a pyproject.toml, but no uv.lock:
https://github.com/NVIDIA-NeMo/Gym/tree/main/responses_api_models/vllm_model
Without a uv.lock, server dependencies can get silently upgraded on server venv setup (e.g. vllm_model depending on vllm ≥ 0.11.2, so vllm is immediately upgraded on a new release), which poses an obstacle to reproducibility, and may introduce regressions or security issues.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting responses_api_models/vllm_model/pyproject.toml and compare the server directory with the repository's other server setups. Add the corresponding uv.lock for each server that has a pyproject.toml, then verify that dependency setup uses the lockfile and preserves reproducible versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100