astral-sh/uv

Force newest lock file format (revision = 3, upload-time=...)

Open

#15220 opened on Aug 11, 2025

View on GitHub
 (13 comments) (3 reactions) (0 assignees)Rust (84,934 stars) (3,111 forks)batch import
enhancementgood first issue

Description

Summary

We use uv lock as a pre-commit hook, with the newest version of uv specified in pre-commit-config.yaml.

However, we still keep getting different versions of uv.lock, depending on which developer pc which local uv version was most recently used to add a library. This causes many unrelated changes in the diff for uv.lock, because older uv versions apparently remove e.g. the upload-time=... sections from all hashes.

The uv lock from the pre-commit hook, which is version-pinned, and should always be the correct version, apparently does not rewrite the lock file, even if the format.revision do not match.

Is there a way to force uv lock to also check the format and revision of the lock file?

The workaround I found is e.g. uv add my-test-package && uv remove my-test-package, which seems like a terrible hack.

Example

uv lock --force -> Rewrite lock file in the newest format, adding revision = 3, upload-time=... for all hashes.

Example of a uv.lock diff that resulted from commits by different developers, not detected by uv lock

--- a/uv.lock
+++ b/uv.lock
@@ -1,4 +1,5 @@
 version = 1
+revision = 3
 requires-python = ">=3.10"
 resolution-markers = [
     "python_full_version >= '3.12.4' and sys_platform != 'win32'",
@@ -24,9 +25,9 @@ members = [
 name = "aiohappyeyeballs"
 version = "2.4.6"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/08/07/508f9ebba367fc3370162e53a3cfd12f5652ad79f0e0bfdf9f9847c6f159/aiohappyeyeballs-2.4.6.tar.gz", hash = "sha256:9b05052f9042985d32ecbe4b59a77ae19c006a78f1344d7fdad69d28ded3d0b0", size = 21726 }
+sdist = { url = "https://files.pythonhosted.org/packages/08/07/508f9ebba367fc3370162e53a3cfd12f5652ad79f0e0bfdf9f9847c6f159/aiohappyeyeballs-2.4.6.tar.gz", hash = "sha256:9b05052f9042985d32ecbe4b59a77ae19c006a78f1344d7fdad69d28ded3d0b0", size = 21726, upload-time = "2025-02-07T17:53:12.277Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/44/4c/03fb05f56551828ec67ceb3665e5dc51638042d204983a03b0a1541475b6/aiohappyeyeballs-2.4.6-py3-none-any.whl", hash = "sha256:147ec992cf873d74f5062644332c539fcd42956dc69453fe5204195e560517e1", size = 14543 },
+    { url = "https://files.pythonhosted.org/packages/44/4c/03fb05f56551828ec67ceb3665e5dc51638042d204983a03b0a1541475b6/aiohappyeyeballs-2.4.6-py3-none-any.whl", hash = "sha256:147ec992cf873d74f5062644332c539fcd42956dc69453fe5204195e560517e1", size = 14543, upload-time = "2025-02-07T17:53:10.304Z" },
 ]

Contributor guide

Tech stack
rustpython
Domain
clideveloper experience
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Rust programmingUnderstanding of uv lock file format
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70
Research direction
The implementation likely involves adding a ` force` flag to the `lock` command in the CLI. The lock file writing logic in `crates/uv/src/lock.rs` or similar should be modified to ignore existing format and always write the newest revision. Ensure that the version and revision fields are updated, and all package entries have `upload time` attributes. Review existing discussion in issue #15220 for potential edge cases.