dependabot / dependabot/dependabot-core

[uv] Version constraint is not applied

Open
#13,640 6 comments 2 reactions 0 assignees View on GitHub
L: javascript L: python L: python:uv T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 14h
Merged PRs (30d)
156

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

uv

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

You can see it at https://github.com/betagouv/aides-agri/blob/4deb0103c11541b5de664b4731bf2be68bb73bec/pyproject.toml:

```toml
[project]
requires-python = ">=3.13"
name = "aides-agri"
version = "0.1.0"
dependencies = [
"beautifulsoup4 ~=4.13",
"django ~=5.2",
"django-admin-extra-buttons ~=2.1",
"django-anymail[brevo] ~=13.0",
"django-csp ~=4.0",
"django-dsfr ~=3.2",
"django-pgtrigger ~=4.15",
"django-reversion ~=6.0",
"django-tasks ~=0.6",
"django-htmx ~=1.23",
"django-two-factor-auth[phonenumberslite] ~=1.17",
"dj-importmap ~=1.0",
"gunicorn ~=23.0",
"markdown ~=3.8",
"markdown-grid-tables ~=0.6",
"markdownify ~=1.1",
"mjml-python ~=1.3",
"psycopg[binary] ~=3.0",
"qrcode ~=7.4",
"requests ~=2.32",
"sentry-sdk[django] ~=2.26",
"whitenoise ~=6.8",
]

[dependency-groups]
dev = [
"djade",
"django-browser-reload",
"django-debug-toolbar ~=5.2.0,<6",
"ruff",
"pytest",
"pytest-cov",
"pytest-django",
"pytest-factoryboy",
"requests-mock",
]

[tool.coverage.run]
omit = ["**/tests/*"]

[tool.coverage.report]
show_missing = true
```

### dependabot.yml content

You can see it at https://github.com/betagouv/aides-agri/blob/4deb0103c11541b5de664b4731bf2be68bb73bec/.github/dependabot.yml:

```yaml
version: 2
updates:
- package-ecosystem: "uv" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "daily"
- package-ecosystem: "npm" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
```

### Updated dependency

In the `dev` dependency group, notice that `django-debug-toolbar` is constrained to `~=5.2.0,<6`.

### What you expected to see, versus what you actually saw

**Expected behavior**: `django-debug-toolbar` should not be upgraded
**Actual behavior**: `django-debug-toolbar` is upgraded to 6.1.0

**Big big hint**:
* Before yesterday, Dependabot was crashing on my manifest (see https://github.com/dependabot/dependabot-core/issues/12888#issuecomment-3414156838).
* Since yesterday, Dependabot is working successfully, probably thanks to #13633
* So most likely, #13633 forgot to implement my slightly exotic version constraint syntax

### Native package manager behavior

Neither `uv lock --upgrade` nor `uv lock --upgrade-package django-debug-toolbar` generate any bump of that lib.

### Images of the diff or a link to the PR, issue, or logs

https://github.com/betagouv/aides-agri/pull/266

### Smallest manifest that reproduces the issue

```toml
[project]
requires-python = ">=3.13"
name = "whatever"
version = "0.1.0"
dependencies = [
"django-debug-toolbar ~=5.2.0,<6",
]
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.