astral-sh/uv

`pip compile --upgrade` behavior with yanked packages

Open

#3,644 opened on May 17, 2024

View on GitHub
 (7 comments) (0 reactions) (0 assignees)Rust (3,111 forks)batch import
help wanted

Repository metrics

Stars
 (84,934 stars)
PR merge metrics
 (Avg merge 7d 16h) (259 merged PRs in 30d)

Description

Prompted at https://github.com/astral-sh/uv/issues/3602#issuecomment-2115761269

When a yanked package is pinned in a lockfile and pip compile --upgrade is used and there is no new version of the package in the input range, should we

  1. Downgrade to the unyanked version
  2. Error that a yanked version is being used
  3. Warn that a yanked version is being used
  4. Silently continue to use the yanked version

Note the yanked package is not pinned in the input requirements.

Contributor guide

Research direction
Evaluate the four options for handling yanked packages in pip compile upgrade and propose a resolution based on user expectations and package safety.
Tech stack
rust
Domain
clitooling
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Python packaginguv usage
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60