fix(pypi): don't expose source-less uv.lock packages#3938
Merged
Conversation
Add news fragment for the uv.lock virtual/root package exposure fix.
`pip.parse(uv_lock = ...)` exposed every package in the lock, including uv
workspace/root members with `source = { virtual = "." }` (and editable installs).
These resolve to no wheel/sdist (srcs = []) but were still marked is_exposed,
so the hub added them to all_requirements / all_whl_requirements and created an
alias to a subpackage that does not exist. Anything enumerating the full set
then failed analysis, e.g. modules_mapping(wheels = all_whl_requirements).
Gate is_exposed on whether the package resolved to any sources, mirroring the
requirements path which already gates is_exposed.
Fixes bazel-contrib#3934
Update _test_uv_lock_primary_source_includes_virtual and the root-pkg case in _test_uv_lock_requires_dist_extras to expect is_exposed = False now that source-less uv.lock packages are no longer exposed.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request ensures that pip.parse(uv_lock = ...) does not expose uv workspace or root members that do not resolve to any wheel or sdist (such as virtual packages or editable installs). This is achieved by setting is_exposed to bool(info["resolved_srcs"]) in _parse_uv_lock_json. Corresponding unit tests have been updated to reflect this change. There are no review comments to address.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
lpulley
marked this pull request as ready for review
July 20, 2026 15:15
aignas
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
I created this PR with AI.
Fixes #3934.
Problem
pip.parse(uv_lock = ...)exposes every[[package]]in the lock, including uv workspace/root members withsource = { virtual = "." }(and editable installs). These resolve to no wheel/sdist (srcs = []) but were still markedis_exposed = True, so the hub adds them toall_requirements/all_whl_requirementsand creates an alias to a subpackage that doesn't exist. Anything enumerating the full set then fails analysis, e.g.modules_mapping(wheels = all_whl_requirements):Fix
_parse_uv_lock_jsoninpython/private/pypi/parse_requirements.bzlsetis_exposed = Trueunconditionally. This gates it on whether the package actually resolved to any sources:The entry is still kept; it just isn't exposed when nothing resolved. This mirrors the requirements path, which already gates
is_exposed.Tests
As called out in the issue, this flips the expectations in two existing tests, both of which assert on source-less packages:
_test_uv_lock_primary_source_includes_virtual(thevirtual_pkgentry)_test_uv_lock_requires_dist_extras(theroot_pkgentry)Both now expect
is_exposed = False.A
news/3934.fixed.mdfragment is included.