Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Upgrade virtualenv in uv.lock without downgrading tox on Python <3.9

Aperta
  • Qualcosa non va?
#395 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
1/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
build-system, devops

Direzione di ricerca

Start with pyproject.toml and uv.lock, then review the Python version markers and dependency resolution described in the issue. Run uv lock --upgrade-package virtualenv on release-v0.9.x and check the lock with uv lock --check; verify tox remains 3.x on Python 3.6–3.8 and virtualenv is at least 21.7.13 on Python 3.9+. Confirm tox runs tox.ini on Python 3.8.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

dependencies DEV: dev-ops TAG: dependencies

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

Dependabot PR #389 bumped virtualenv from 20.16.2 (py3.6–3.7) and 21.2.0 (py3.8+) to 21.7.13, which fixes path command injection in the bash and fish activation scripts (pypa/virtualenv#3252). It was closed unmerged because it collapsed virtualenv to one version for every Python. On Python <3.9 that left tox<4 resolving to tox 1.1 (2011) instead of 3.14.6, and tox 1.1 cannot run this repo's tox.ini.

Complexity: Low
Target branch: release-v0.9.x

Context
  • pyproject.toml pins tox<4 on Python <3.9 and tox>=4 plus tox-uv on 3.9+.
  • tox 3.x depends on virtualenv, so the lock needs a separate virtualenv version on each Python range tox 3.x runs on. tox 1.1 has no virtualenv dependency, which is how the resolver picked it.
  • The py3.6–3.8 CI jobs pip install tox without the lockfile, so CI passed on #389 despite the broken lock.
  • uv lock --upgrade-package virtualenv on release-v0.9.x keeps tox 3.14.6 and resolves virtualenv to 20.16.2 (py3.6–3.7), 21.4.3 (py3.8) and 21.14.5 (py3.9+).
The Change
  • virtualenv should be upgraded in uv.lock to a release that includes pypa/virtualenv#3252 on every Python range that has one.
  • python-discovery moves with it: virtualenv 21.x depends on it.
  • tox and the virtualenv versions locked for py3.6–3.8 have to stay compatible with each other, since the newer virtualenv releases have dropped those Pythons.
Acceptance Criteria
  • uv.lock resolves tox to 3.x on Python 3.6, 3.7 and 3.8.
  • uv.lock resolves virtualenv to ≥ 21.7.13 on Python 3.9+.
  • uv lock --check passes.
  • tox runs this repo's tox.ini on Python 3.8 with the locked dependencies.
References
  • Closed Dependabot PR: #389

AI usage

Claude Code drafted this from its review of #389 and checked the resolution by relocking the base branch.

Filed from #389's review.

Lingua principale
Python
Stelle
15
Fork
23
Merge medio
2g 22h
PR unite (30g)
4

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di learningequality/morango

Tutte le issue di learningequality/morango

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.