Fix hosted uv missing uv<0.5.6 advisories (#1569)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1569

Summary

A hosted uv scan can wire the patched package in two ways that uv before
0.5.5 doesn't honour:

• Transitive package: a [tool.uv] override-dependencies entry plus a
  [tool.uv.sources] url. On old uv a plain uv sync re-resolves the
  override against the registry and silently reinstalls the unpatched
  wheel.
• Package in constraint-dependencies: the lock's [manifest] constraints / build-constraints entry is repointed, and old uv rejects
  that under uv sync --locked.

Vendored mode already warned about both (pypi_uv_override_requires_uv_0_5_6,
pypi_uv_constraints_require_uv_0_5_6). Hosted mode warned about neither and
exited 0. Now hosted scans emit redirect_uv_override_requires_uv_0_5_6 and
redirect_uv_constraints_require_uv_0_5_6 when they write that wiring, for
project and PEP 723 script locks. These are advisories only: the redirect
still counts, the exit code doesn't change, and a settled re-run says nothing.

Root cause

rewrite_uv_lock (patch/redirect/mod.rs) confirms the pin without looking
at which wiring shape it used, so the uv-version advisories that
vendor/pypi_uv.rs emits for the same shapes had no hosted equivalent.

Changes

• rewrite_uv_lock: once a dep is confirmed and this run changed its
  wiring, check whether the paired pyproject/script reaches it through an
  override (a marked entry or the user's own) and whether the lock's
  [manifest] constrains it. The constraints check reads the lock session's
  existing parsed document, so the lock isn't parsed again.
• Hosted and vendored share one advisory text (utils/python_script.rs).
  The text now gives the measured affected range (uv before 0.5.5, per
  docs/testing/uv-compatibility.md) and keeps the documented >= 0.5.6
  advice. Before, the constraints text said only 0.2.37–0.5.3 were affected,
  but 0.5.4 rejects the entry too.
• UV_OLD_RELEASE_ADVISORIES: excluded from the "see the warning below"
  count and from the takeover's skip-reason lookup, because they describe a
  pin that landed.
• CLI_CONTRACT.md row and uv-compatibility.md notes.

Test evidence

• New patch::redirect::uv_old_release_advisories tests: transitive
  override (LF and CRLF), repointed constraint, a user-written override
  under a non-canonical Six grant, script-lock override, and a silent
  direct dependency. Before the fix: 3 failed (left: [], expected the
  code). After the fix: all pass.
• python_lock_rewrite.golden re-blessed. To check it, I filtered out the
  two new codes in the harness and matched the previous golden exactly
  across all 1500 seeded cases. The sweep now has to reach both codes.
• tests/uv_hosted.rs: the transitive case expects the override advisory.
• Real uv 0.12.17, cargo test -p socket-patch-cli --all-features --test e2e_redirect_uv_build -- --ignored: 9/9 pass. The hosted transitive and
  constraints lanes now assert their advisory, and every other lane asserts
  that neither code appears.
• cargo fmt --all -- --check and cargo clippy --locked --workspace --all-features -- -D warnings: clean. cargo test -p socket-patch-cli --lib: 921 pass.
• Full cargo test --workspace --all-features --no-fail-fast: the only
  failures were tests that can't pass in this sandbox, which runs as root
  with no route to patches-api.socket.dev: chmod-based write-failure tests
  (poetry/requirements wire rollback, repair cleanup, vlt heal, copy_tree
  symlink) and the network-backed e2e_bun_lockb rollback. None of them
  touch uv. CI runs them as non-root.

Per-issue checklist

• Hosted uv scan gives no uv < 0.5.6 advisory for transitive overrides or repointed constraints, so on uv ≤ 0.5.4 a plain uv sync silently reinstalls the unpatched wheel after a clean exit 0 #1569 transitive override lane → transitive_override_wiring_advises_uv_0_5_6, user_written_override_advises_uv_0_5_6, transitive_script_override_advises_uv_0_5_6, e2e hosted_uv_transitive_override_manifestless_vex
• Hosted uv scan gives no uv < 0.5.6 advisory for transitive overrides or repointed constraints, so on uv ≤ 0.5.4 a plain uv sync silently reinstalls the unpatched wheel after a clean exit 0 #1569 constraint lane → repointed_manifest_constraint_advises_uv_0_5_6, e2e hosted_uv_constraints_manifestless_vex

Bugbot

• Takeover explain could name a uv advisory as a package's skip reason through the names_package pass. Fixed in 21f5d28 with the regression test uv_old_release_advisories_never_explain_a_skip, which goes red to green.

Review notes (/code-review high)

Fixed: user-written overrides were missed, takeover skip-reason list,
wrong version range in the text, non-canonical name, an extra lock parse,
duplicated text, and the e2e absence check. Not changed: re-emitting on a
re-pin to a superseding patch. That run rewrites the same fragile wiring, so
the advisory still applies; the contract now says so.

🤖 Generated with Claude Code

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 21f5d28. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at 21f5d28: CI 35/35 green (19 skipped), no conflicts, Bugbot reviewed this head with no findings and the one earlier review thread is resolved. Reviewers: the new hosted advisories redirect_uv_override_requires_uv_0_5_6 / redirect_uv_constraints_require_uv_0_5_6 are warnings only and don't change exit codes.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] I verified this PR (head 21f5d28) against real uv 0.5.3 and 0.13.1 on Linux with the bughunt mock patch server, comparing it with main 657fce2:

Lane	main hosted	PR hosted	vendored (both)
transitive six (isodate)	none	redirect_uv_override_requires_uv_0_5_6	pypi_uv_override_requires_uv_0_5_6
six direct + constraint-dependencies	none	redirect_uv_constraints_require_uv_0_5_6	pypi_uv_constraints_require_uv_0_5_6
transitive + constraint	none	both codes	both codes
direct six	none	none	none

• An idempotent re-scan is silent in every lane.
• H→V and V→H takeovers on 0.5.3 each emit the advisory for the new mode.
• On 0.5.3, uv sync --locked exits 2 and a plain sync rewrites the lock and installs unpatched six, matching the advisory text. On 0.13.1 both stay patched.

No issues found.

---

Generated by Claude Code