leanprover / leanprover/lean4

lake update does not update transitive dependency pins

Open
#13,084 6 comments 0 reactions 1 assignee View on GitHub

@tydeu is already working on this.

Since Mar 24, 2026.

bug Lake P-medium
Dominant language
Lean
Stars
9.2k
Forks
990
Avg merge
1d 17h
Merged PRs (30d)
175

Description

When running lake update, direct dependencies are updated to their latest commits, but transitive dependencies are not re-resolved from the updated upstream package's manifest. This means stale transitive dependency pins can silently persist even after the direct dependency has been updated.

Reproduction

Given three projects:

  • C (e.g. subverso) — a library
  • B (e.g. verso) — depends on C via require C from git "..."@"main"
  • A (e.g. reference-manual) — depends on B via require B from git "..."@"main"
  1. A's lake-manifest.json has B pinned at commit b1 and C pinned at commit c1
  2. B is updated: B's main now points to b2, and B's manifest pins C at c2
  3. Run lake update in A

Expected: A's manifest updates B to b2 and C to c2 (from B's updated manifest)

Actual: A's manifest updates B to b2 but keeps C at c1

Concrete example

This happened during the v4.29.0-rc7 release with the reference-manual:

  • subverso got a fix at 21e4badfe6a6 ("chore: prefer inferInstance, for v4.29.0-rc7")
  • verso's main (7ad685cf1a9e) updated its manifest to pin the fixed subverso
  • Running lake update in reference-manual updated verso to 7ad685cf1a9e but kept subverso at the old 699813355084, causing a build failure

The only workaround was to manually edit lake-manifest.json to update the subverso rev.

🤖 Prepared with Claude Code

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.