dependabot / dependabot/dependabot-core
[uv] Version constraint is not applied
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 156
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
uv
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
You can see it at https://github.com/betagouv/aides-agri/blob/4deb0103c11541b5de664b4731bf2be68bb73bec/pyproject.toml:
```toml
[project]
requires-python = ">=3.13"
name = "aides-agri"
version = "0.1.0"
dependencies = [
"beautifulsoup4 ~=4.13",
"django ~=5.2",
"django-admin-extra-buttons ~=2.1",
"django-anymail[brevo] ~=13.0",
"django-csp ~=4.0",
"django-dsfr ~=3.2",
"django-pgtrigger ~=4.15",
"django-reversion ~=6.0",
"django-tasks ~=0.6",
"django-htmx ~=1.23",
"django-two-factor-auth[phonenumberslite] ~=1.17",
"dj-importmap ~=1.0",
"gunicorn ~=23.0",
"markdown ~=3.8",
"markdown-grid-tables ~=0.6",
"markdownify ~=1.1",
"mjml-python ~=1.3",
"psycopg[binary] ~=3.0",
"qrcode ~=7.4",
"requests ~=2.32",
"sentry-sdk[django] ~=2.26",
"whitenoise ~=6.8",
]
[dependency-groups]
dev = [
"djade",
"django-browser-reload",
"django-debug-toolbar ~=5.2.0,<6",
"ruff",
"pytest",
"pytest-cov",
"pytest-django",
"pytest-factoryboy",
"requests-mock",
]
[tool.coverage.run]
omit = ["**/tests/*"]
[tool.coverage.report]
show_missing = true
```
### dependabot.yml content
You can see it at https://github.com/betagouv/aides-agri/blob/4deb0103c11541b5de664b4731bf2be68bb73bec/.github/dependabot.yml:
```yaml
version: 2
updates:
- package-ecosystem: "uv" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "daily"
- package-ecosystem: "npm" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
```
### Updated dependency
In the `dev` dependency group, notice that `django-debug-toolbar` is constrained to `~=5.2.0,<6`.
### What you expected to see, versus what you actually saw
**Expected behavior**: `django-debug-toolbar` should not be upgraded
**Actual behavior**: `django-debug-toolbar` is upgraded to 6.1.0
**Big big hint**:
* Before yesterday, Dependabot was crashing on my manifest (see https://github.com/dependabot/dependabot-core/issues/12888#issuecomment-3414156838).
* Since yesterday, Dependabot is working successfully, probably thanks to #13633
* So most likely, #13633 forgot to implement my slightly exotic version constraint syntax
### Native package manager behavior
Neither `uv lock --upgrade` nor `uv lock --upgrade-package django-debug-toolbar` generate any bump of that lib.
### Images of the diff or a link to the PR, issue, or logs
https://github.com/betagouv/aides-agri/pull/266
### Smallest manifest that reproduces the issue
```toml
[project]
requires-python = ">=3.13"
name = "whatever"
version = "0.1.0"
dependencies = [
"django-debug-toolbar ~=5.2.0,<6",
]
```
Contributor guide
Assessment
This issue has not been assessed yet.