From 1fc146e37bc00e68da152157c7b8c660cc47f289 Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 7 Oct 2026 13:55:58 -0400 Subject: [PATCH 1/4] PYTHON-6151 Define exclude-newer in pyproject.toml The uv-lock-update workflow exported UV_EXCLUDE_NEWER, so the lock and check invocations saw different configs and uv lock --check failed. Define the 7 day cutoff in pyproject.toml so every uv invocation reads the same config. --- pyproject.toml | 4 ++++ uv.lock | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/pyproject.toml b/pyproject.toml index cf824a72f2..f595c4e561 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -53,6 +53,10 @@ Tracker = "https://jira.mongodb.org/projects/PYTHON/issues" # install-dependencies.sh installs it in Evergreen. Bump manually when a newer uv # is needed. required-version = "==0.12.12" +# Skip dependency releases newer than 7 days. Defined here, not in CI env, +# so every uv invocation sees the same cutoff. The span floats, so no date +# to bump. +exclude-newer = "7 days" # boto3 dropped Python 3.9 support in 1.43, so the universal lock forks at # 3.10. Without a floor the pre-3.10 fork back-solves to boto3 1.7.84 (2018), # whose vendored six and invalid escape sequences break test collection. No diff --git a/uv.lock b/uv.lock index 765a4b3299..e1801e0a33 100644 --- a/uv.lock +++ b/uv.lock @@ -8,6 +8,10 @@ resolution-markers = [ "python_full_version <= '3.9'", ] +[options] +exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values. +exclude-newer-span = "P7D" + [manifest] constraints = [{ name = "boto3", specifier = ">=1.34" }] From 47969f9cb758201ea4897d344f3ca6e41cf53ac5 Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 7 Oct 2026 13:59:10 -0400 Subject: [PATCH 2/4] PYTHON-6151 Update uv lock docs for pyproject cutoff --- CONTRIBUTING.md | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7f24a3aca3..97bb167f8e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -639,15 +639,11 @@ and in CI. Continuous integration runs `uv lock --check`, which fails when the l no longer matches `pyproject.toml`. If that check fails on your pull request, regenerate the lock file and commit the result. -The scheduled workflow's `uv-lock-update` action applies a 7 day cutoff -(`exclude_newer: 7 days`, passed to uv as `UV_EXCLUDE_NEWER`) so a package version -yanked shortly after release is less likely to land in the lock file. That cutoff -lives in the action, not in `pyproject.toml`, so it does not apply automatically -when you run `uv lock` locally — set `UV_EXCLUDE_NEWER` yourself so a freshly -published (and possibly still-to-be-yanked) release doesn't end up in the lock file: +A 7 day cutoff (`exclude-newer` in `pyproject.toml`) applies automatically, so a package +version yanked shortly after release is less likely to land in the lock file: ```bash -UV_EXCLUDE_NEWER="7 days" uv lock +uv lock ``` To resolve a `uv.lock` conflict when rebasing, check out either side and regenerate @@ -657,6 +653,6 @@ rather than editing the file by hand. Which side you pick does not matter, becau ```bash git checkout --ours uv.lock -UV_EXCLUDE_NEWER="7 days" uv lock +uv lock git add uv.lock ``` From 14dd450088f2518e988c563ba13ff6fb6b7259ad Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 7 Oct 2026 14:17:33 -0400 Subject: [PATCH 3/4] PYTHON-6151 Shorten exclude-newer comment --- pyproject.toml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index f595c4e561..621200015f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -53,9 +53,8 @@ Tracker = "https://jira.mongodb.org/projects/PYTHON/issues" # install-dependencies.sh installs it in Evergreen. Bump manually when a newer uv # is needed. required-version = "==0.12.12" -# Skip dependency releases newer than 7 days. Defined here, not in CI env, -# so every uv invocation sees the same cutoff. The span floats, so no date -# to bump. +# Skip dependency releases newer than 7 days. Defining it here keeps every uv +# invocation on the same cutoff. exclude-newer = "7 days" # boto3 dropped Python 3.9 support in 1.43, so the universal lock forks at # 3.10. Without a floor the pre-3.10 fork back-solves to boto3 1.7.84 (2018), From 8ae6f0cb1522427ef1e96bf173da4e7f60ce6399 Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 7 Oct 2026 14:22:54 -0400 Subject: [PATCH 4/4] PYTHON-6151 Take uv cutoff from pyproject, not action default --- .github/workflows/uv-lock-update.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/uv-lock-update.yml b/.github/workflows/uv-lock-update.yml index 1a064e39d2..ae738eea88 100644 --- a/.github/workflows/uv-lock-update.yml +++ b/.github/workflows/uv-lock-update.yml @@ -40,3 +40,6 @@ jobs: app_id: ${{ vars.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} dry_run: ${{ inputs.dry_run || 'false' }} + # Unset UV_EXCLUDE_NEWER, so the cutoff comes from exclude-newer in + # pyproject.toml instead of the action default. + exclude_newer: ""