@vercel/python 25.1.3 → 26.0.1

package/dist/index.js

@@ -5523,11 +5523,18 @@ var UvRunner = class {
   }
   /**
    * Run a `uv pip` command (e.g., `uv pip install`).
+   *
+   * Only packages the builder adds on top of the user's dependencies are
+   * installed this way. Their pins carry no hashes, so the user's
+   * UV_REQUIRE_HASHES is dropped; uv also rejects `--no-require-hashes`
+   * while it is set.
    */
   async pip(options) {
     const { venvPath, projectDir, args } = options;
     const fullArgs = ["pip", ...args];
-    await this.runUvCmd(fullArgs, projectDir, venvPath);
+    await this.runUvCmd(fullArgs, projectDir, venvPath, {
+      UV_REQUIRE_HASHES: void 0
+    });
   }
   /**
    * Run a command through `uv run` inside the active virtual environment.
@@ -5559,13 +5566,13 @@ var UvRunner = class {
       );
     }
   }
-  async runUvCmd(args, cwd, venvPath) {
+  async runUvCmd(args, cwd, venvPath, env) {
     const pretty = `uv ${args.join(" ")}`;
     (0, import_build_utils2.debug)(`Running "${pretty}"...`);
     try {
       await (0, import_execa2.default)(this.uvPath, args, {
         cwd,
-        env: this.getVenvEnv(venvPath)
+        env: { ...this.getVenvEnv(venvPath), ...env }
       });
     } catch (err) {
       const error = new Error(
@@ -9243,20 +9250,21 @@ async function doInstallInjectedDevPackage(pkg, opts) {
     `Installing ${pkg.name} into ${targetDir} (type: ${isLocalDev ? "local" : "pypi"}, source: ${dep})`
   );
   const pip = uvPath ? { cmd: uvPath, prefix: ["pip", "install"] } : { cmd: pythonBin, prefix: ["-m", "pip", "install"] };
-  const excludeOverride = uvPath ? ["--exclude-newer-package", `${pkg.name}=false`] : [];
+  const uvOverrides = uvPath ? ["--exclude-newer-package", `${pkg.name}=false`, "--no-require-hashes"] : [];
   const extras = pkg.envOverride || isLocalDev ? [] : pkg.extraRequirements ?? [];
   const spawnArgs = [
     ...pip.prefix,
     "--target",
     targetDir,
-    ...excludeOverride,
+    ...uvOverrides,
     ...extras,
     dep
   ];
   await new Promise((resolve4, reject) => {
     const child = (0, import_child_process2.spawn)(pip.cmd, spawnArgs, {
       cwd: workPath,
-      env: getProtectedUvEnv(env),
+      // uv rejects `--no-require-hashes` while UV_REQUIRE_HASHES is set.
+      env: { ...getProtectedUvEnv(env), UV_REQUIRE_HASHES: void 0 },
       stdio: ["inherit", "pipe", "pipe"]
     });
     child.stdout?.on("data", (data) => {
@@ -11745,6 +11753,9 @@ async function installInjectedPackage({
       "install",
       "--link-mode",
       "copy",
+      // The pin has no hash, so override `require-hashes` from the user's
+      // uv config. `uv.pip` drops UV_REQUIRE_HASHES.
+      "--no-require-hashes",
       ...pipPlatformArgs,
       ...noExclude,
       ...extras,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/python",
-  "version": "25.1.3",
+  "version": "26.0.1",
   "main": "./dist/index.js",
   "license": "Apache-2.0",
   "homepage": "https://vercel.com/docs/runtimes#official-runtimes/python",
@@ -14,10 +14,10 @@
     "directory": "packages/python"
   },
   "dependencies": {
-    "@vercel/python-analysis": "0.15.0"
+    "@vercel/python-analysis": "0.15.1"
   },
   "peerDependencies": {
-    "@vercel/build-utils": "14.21.3"
+    "@vercel/build-utils": "14.22.0"
   },
   "devDependencies": {
     "@renovatebot/pep440": "4.2.1",
@@ -37,7 +37,7 @@
     "smol-toml": "1.5.2",
     "vitest": "4.1.10",
     "which": "3.0.0",
-    "@vercel/build-utils": "14.21.3",
+    "@vercel/build-utils": "14.22.0",
     "@vercel/error-utils": "2.2.1",
     "@vercel/python-runtime": "0.23.3"
   },