`markupsafe` resolves to 3.0.3 (download.pytorch.org/whl) or 3.0.2 (download.pytorch.org/whl/nightly) depending on install path (pip install .` with the index configuration committed in the repo)Misc. bug:

### Name and Version

main @ `2f2d44052b7d`

### Operating systems

Linux

### Which llama.cpp modules do you know to be affected?

Python/Bash scripts

### Command line

```shell
N/A
```

### Problem description & steps to reproduce

Dry-run resolutions (nothing is installed), Python 3.11, Linux x86_64, pip 26.2.1 / uv 0.12.10, index state of 2026-09-07:

```bash
# A: `pip install .` with the index configuration committed in the repo
pip install --dry-run --report a.json "jinja2" --extra-index-url https://download.pytorch.org/whl/cpu --extra-index-url https://download.pytorch.org/whl/nightly
# -> `MarkupSafe 3.0.3` from download.pytorch.org/whl

# B: `uv sync` / `uv pip install .` (pyproject with `[tool.uv.sources]`)
uv lock # in the repo checkout (honours [tool.uv.sources]); or: uv pip compile --emit-index-annotation -o b.txt req.txt --extra-index-url https://download.pytorch.org/whl/cpu --extra-index-url https://download.pytorch.org/whl/nightly # req.txt: "jinja2"
# -> `markupsafe 3.0.2` from download.pytorch.org/whl/nightly
```

### Expected behavior

Every documented install path selects the same file for the package(s) above (same version, same index, same hash), or the documentation states which build is intended.

### First Bad Commit

N/A

### Relevant log output

Logs

```console
# pip --report / uv lock: selected files
[A] MarkupSafe==3.0.3 https://download.pytorch.org/whl/markupsafe-3.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl
[B] markupsafe==3.0.2 https://download.pytorch.org/whl/nightly/MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
```

### Description

The repository documents more than one way to install it, and they do not produce the same environment: following `pip install .` with the index configuration committed in the repo installs `MarkupSafe 3.0.3` from download.pytorch.org/whl, while following `uv sync` / `uv pip install .` installs `markupsafe 3.0.2` from download.pytorch.org/whl/nightly. Nothing in the project indicates that these general-purpose packages should come from the PyTorch index, yet one path silently takes years-old copies from it; users on the two paths run different versions of the same libraries without any visible signal. Because the selection is decided by index visibility and installer semantics rather than by the project, it is also an exposure: whichever index publishes a higher version of these names decides what gets installed.

**`markupsafe`** (transitive):
- `pip install .` with the index configuration committed in the repo → `MarkupSafe 3.0.3` from download.pytorch.org/whl
- `uv sync` / `uv pip install .` (pyproject with `[tool.uv.sources]`) → `markupsafe 3.0.2` from download.pytorch.org/whl/nightly

### Root cause and proposed fix

**Consequences**

- Common packages are pinned to years-old copies from the PyTorch channel under uv (e.g. an outdated CA bundle in `certifi`), while pip users get current releases.
- The environment produced by one path is not the one exercised in CI, so bug reports are hard to reproduce.
- With `--extra-index-url`, pip installs whichever index publishes the highest version of a name. For unpinned names this means any index in the set (or anyone able to publish to it) can decide which artifact is installed; this is the pre-condition of dependency-confusion attacks.
- The two paths install files with different hashes from different indexes; which build (and whose build) ends up in the environment is decided by index order and installer behaviour rather than by the project's declaration, and the two files were not verified against each other here.

**Root cause**

The two paths expose different index sets; each resolver picks the highest version among the indexes it sees, so the selected release depends on the path. `[tool.uv.sources]` is honoured only by uv; every `pip install` command in the docs/Dockerfile ignores it and resolves from the indexes on its own command line.

**Proposed fix**

1. Do not let the PyTorch channel serve general-purpose packages: pass it only for the torch packages (`--index-url` in a separate step), or in uv mark it `explicit = true` so `markupsafe` always come from PyPI.
2. Commit a lock (`uv.lock`, or `pip-compile`/`pip lock` output with hashes) and make the README/Dockerfile/CI install from it, so every documented path resolves identical files.

**Selected files**

| case | install path | package | version | index | file | sha256 |
|---|---|---|---|---|---|---|
| 1 | `pip install .` with the index configuration committed in the repo | `MarkupSafe` | 3.0.3 | download.pytorch.org/whl | [markupsafe-3.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl](https://download.pytorch.org/whl/markupsafe-3.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl) | `not published` |
| 1 | `uv sync` / `uv pip install .` (pyproject with `[tool.uv.sources]`) | `markupsafe` | 3.0.2 | download.pytorch.org/whl/nightly | [MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl](https://download.pytorch.org/whl/nightly/MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl) | `not published` |

Found by an automated check that resolves the declared dependencies under each documented install path and diffs the selected files. File URLs and sha256 hashes are listed above so the result can be re-checked independently.

### Environment

- pip 26.2.1, uv 0.12.10, CPython 3.11, Linux x86_64 (Ubuntu 24.04 on WSL2)
- repository at commit `2f2d44052b7d15c9c4dd6610f6e14a5f7b2d5f3f`
- index contents as observed on 2026-09-07; file URLs and sha256 in the table below make the result re-checkable