Repository navigation
fix(pypi): handle revisions in uv.lock Git sources - #4086
Merged
aignas merged 1 commit intoAug 22, 2026
Merged
Conversation
This was referenced Aug 22, 2026
Closed
rickeylev
added a commit
that referenced
this pull request
Aug 22, 2026
Cherry-picks: - #4044 - #4054 - #4086 - #4083 Extra fixes (PR to main in #4090): - doc: changelog entries for 2.3.2 - chore: fix version numbers Work towards #4088 --------- Co-authored-by: Richard Levasseur <richardlev@gmail.com> Co-authored-by: Kristian Hartikainen <kristian@ekarobotics.com> Co-authored-by: Henrique <121921605+henriquejsza@users.noreply.github.com>
rickeylev
pushed a commit
to rickeylev/rules_python
that referenced
this pull request
Oct 5, 2026
`pip.parse(uv_lock = ...)` passes a git-sourced package's raw uv source string (`https://host/repo?rev=<ref>#<commit>`) to the Bazel downloader as a URL, which cannot fetch a git repository (bazel-contrib#4139). bazel-contrib#4086 fixed the invalid repo name for these sources but kept the URL, so they still fail at fetch time. This makes uv.lock git sources match how a `foo @ git+...` line from a requirements file is already handled: - The src gets an empty `url` and `filename`, so `_whl_repo` takes the existing pip path instead of the downloader. - The requirement line becomes a pip direct reference, `foo @ git+<repo url>@<commit>`, pinned to the commit uv resolved rather than the requested `rev`/`tag`/`branch`. Before, it was `foo==<version>`, which pip cannot satisfy for a VCS-only version such as `0.12.0a0+39be1c6`. - A `subdirectory` query parameter carries over as `#subdirectory=<dir>`. uv percent-encodes it (`subdirectory=python%2Ffoo`) and pip reads the fragment as a literal path, so it is decoded. I checked both against uv 0.9.30 and pip 26.2.1: pip fails on the encoded form with "does not appear to be a Python project" and builds the decoded one. Tests: updated `test_uv_lock_vcs_entry` for the new src shape and added `test_uv_lock_vcs_entry_subdirectory`. `//tests/pypi/parse_requirements/...` and `//tests/pypi/hub_builder/...` pass. End to end, a large monorepo using `pip.parse(uv_lock = ...)` builds its git-sourced `torchdata` dependency against this branch via `--override_module`; we have been carrying the same change as a patch on 2.3.1. Fixes bazel-contrib#4139
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Git sources in
uv.lockcan include a revision in the URL query andfragment.
pip.parsecurrently includes those components in the derivedfilename, which can produce an invalid Bazel repository name.
Derive the filename from only the URL path while preserving the complete
revision-bearing Git URL. Regression coverage verifies the filename is clean
and the fetch URL remains unchanged.
Fixes #4084