lockfloor 0.1.0__py3-none-any.whl

lockfloor/__init__.py

@@ -0,0 +1,3 @@
+"""Raise pyproject.toml lower bounds to the versions uv's resolver locks together."""
+
+__version__ = "0.1.0"

lockfloor/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from lockfloor.cli import main
+
+sys.exit(main())

lockfloor/cli.py

@@ -0,0 +1,213 @@
+"""lockfloor: raise pyproject.toml lower bounds to the versions uv's resolver locks together."""
+
+from __future__ import annotations
+
+import argparse
+import logging
+import sys
+from pathlib import Path
+
+from packaging.requirements import InvalidRequirement, Requirement
+from packaging.utils import canonicalize_name
+
+from lockfloor import __version__
+from lockfloor.lockfile import LockIndex
+from lockfloor.manifest import (
+    Manifest,
+    ProjectError,
+    Slot,
+    find_workspace_root,
+    load_manifest,
+    requirement_slots,
+    workspace_manifests,
+)
+from lockfloor.plan import Row, plan_rows
+from lockfloor.resolver import ResolveError, UvResolver
+from lockfloor.specifier import is_pin, loosen_pin, split_name
+
+logger = logging.getLogger("lockfloor")
+
+EXIT_OK = 0
+EXIT_UPGRADES_PENDING = 1
+EXIT_ERROR = 2
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="lockfloor",
+        description=(
+            "Raise pyproject.toml lower bounds to the versions uv's resolver locks together. "
+            "Dry run by default."
+        ),
+    )
+    parser.add_argument("names", nargs="*", metavar="DEPENDENCY", help="only these dependencies (default: all)")
+    parser.add_argument("--project", type=Path, default=Path.cwd(), help="project or workspace directory")
+    parser.add_argument(
+        "--package", action="append", default=[], metavar="MEMBER", help="only this workspace member (repeatable)"
+    )
+    parser.add_argument(
+        "--group",
+        action="append",
+        default=[],
+        metavar="GROUP",
+        help="only this group: main, a dependency-group name, or extra:NAME (repeatable)",
+    )
+    parser.add_argument("--pins", action="store_true", help="also move single == pins to the resolved version")
+    mode = parser.add_mutually_exclusive_group()
+    mode.add_argument("--write", action="store_true", help="rewrite pyproject.toml files and re-lock")
+    mode.add_argument("--check", action="store_true", help="exit 1 when any floor can be raised (for CI)")
+    parser.add_argument("--timeout", type=float, default=300.0, help="seconds allowed per uv call (default 300)")
+    parser.add_argument("-v", "--verbose", action="store_true", help="log the uv commands")
+    parser.add_argument("--version", action="version", version=f"lockfloor {__version__}")
+    return parser
+
+
+def main(argv: list[str] | None = None, resolver: object | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    logging.basicConfig(level=logging.DEBUG if args.verbose else logging.WARNING, format="%(name)s: %(message)s")
+    if args.timeout <= 0:
+        print("lockfloor: --timeout must be positive", file=sys.stderr)
+        return EXIT_ERROR
+    try:
+        return _run(args, resolver or UvResolver(args.timeout))
+    except (ProjectError, ResolveError) as exc:
+        print(f"lockfloor: {exc}", file=sys.stderr)
+        return EXIT_ERROR
+
+
+def _run(args: argparse.Namespace, resolver) -> int:
+    root = find_workspace_root(args.project)
+    manifests = workspace_manifests(root)
+    slots = _select(manifests, args)
+    if not slots:
+        print("lockfloor: no requirements to look at")
+        return EXIT_OK
+
+    filtered = bool(args.names or args.group or args.package)
+    upgrade = sorted({_name(s.raw) for s in slots if _name(s.raw)}) if filtered else None
+    pins = [s for s in slots if args.pins and is_pin(s.raw)]
+    lock_text = resolver.upgraded_lock(root, upgrade, _pin_loosener(root, pins), _paths_escape(root, manifests))
+
+    rows = plan_rows(slots, LockIndex(lock_text), pins=args.pins)
+    print(render_table(rows, show_member=len(manifests) > 1))
+    raised = [r for r in rows if r.raises]
+    skipped = [r for r in rows if r.verdict.skip]
+    current = len(rows) - len(raised) - len(skipped)
+    print(f"\n{len(raised)} to raise, {len(skipped)} left alone, {current} already at the resolved version.")
+
+    if args.check:
+        return EXIT_UPGRADES_PENDING if raised else EXIT_OK
+    if not args.write:
+        print("Dry run: no file was written. Pass --write to apply and re-lock.")
+        return EXIT_OK
+    if not raised:
+        return EXIT_OK
+    _apply(root, raised, lock_text, resolver)
+    files = sorted({r.slot.manifest.path.relative_to(root).as_posix() for r in raised})
+    print(f"Wrote {', '.join(files)} and re-locked uv.lock.")
+    return EXIT_OK
+
+
+def _select(manifests: list[Manifest], args: argparse.Namespace) -> list[Slot]:
+    slots = [slot for manifest in manifests for slot in requirement_slots(manifest)]
+    if args.package:
+        known = {canonicalize_name(m.label): m for m in manifests}
+        wanted = {canonicalize_name(p) for p in args.package}
+        unknown = wanted - known.keys()
+        if unknown:
+            raise ProjectError(f"--package {', '.join(sorted(unknown))} is not a workspace member; members: {', '.join(m.label for m in manifests)}")
+        slots = [s for s in slots if canonicalize_name(s.manifest.label) in wanted]
+    if args.group:
+        labels = {s.group_label for s in slots}
+        unknown = set(args.group) - labels
+        if unknown:
+            raise ProjectError(f"--group {', '.join(sorted(unknown))} not found; groups here: {', '.join(sorted(labels))}")
+        slots = [s for s in slots if s.group_label in args.group]
+    if args.names:
+        wanted_names = {canonicalize_name(n) for n in args.names}
+        slots = [s for s in slots if _name(s.raw) in wanted_names]
+        if not slots:
+            raise ProjectError(f"no requirement named {', '.join(args.names)} in the selected groups")
+    return slots
+
+
+def _name(raw: str) -> str | None:
+    try:
+        return canonicalize_name(Requirement(raw).name)
+    except InvalidRequirement:
+        return None
+
+
+def _pin_loosener(root: Path, pins: list[Slot]):
+    """Return a callback that rewrites `==X` to `>=X` in the scratch copy, so uv may move the pin."""
+
+    def loosen(copy: Path) -> None:
+        by_file: dict[Path, list[Slot]] = {}
+        for slot in pins:
+            by_file.setdefault(slot.manifest.path, []).append(slot)
+        for path, file_pins in by_file.items():
+            scratch_manifest = load_manifest(copy / path.relative_to(root), copy)
+            scratch_slots = {(s.section, s.group, s.index): s for s in requirement_slots(scratch_manifest)}
+            for pin in file_pins:
+                scratch_slots[(pin.section, pin.group, pin.index)].replace(loosen_pin(pin.raw))
+            scratch_manifest.path.write_bytes(scratch_manifest.dump())
+
+    return loosen
+
+
+def _paths_escape(root: Path, manifests: list[Manifest]) -> bool:
+    """True when a [tool.uv.sources] path points outside the workspace root."""
+    for manifest in manifests:
+        sources = ((manifest.document.get("tool") or {}).get("uv") or {}).get("sources") or {}
+        for source in sources.values():
+            for entry in source if isinstance(source, list) else [source]:
+                path = entry.get("path") if hasattr(entry, "get") else None
+                if path and not (manifest.path.parent / str(path)).resolve().is_relative_to(root):
+                    return True
+    return False
+
+
+def _apply(root: Path, raised: list[Row], lock_text: str, resolver) -> None:
+    """Rewrite manifests, adopt the resolved lock, re-lock; restore every byte if any step fails."""
+    lock_path = root / "uv.lock"
+    lock_before = lock_path.read_bytes() if lock_path.exists() else None
+    touched = {id(r.slot.manifest): r.slot.manifest for r in raised}.values()
+    done = False
+    try:
+        for row in raised:
+            row.slot.replace(row.verdict.new)
+        for manifest in touched:
+            manifest.path.write_bytes(manifest.dump())
+        lock_path.write_bytes(lock_text.encode("utf-8"))
+        resolver.relock(root)
+        done = True
+    finally:
+        if not done:
+            for manifest in touched:
+                manifest.path.write_bytes(manifest.original)
+            if lock_before is None:
+                lock_path.unlink(missing_ok=True)
+            else:
+                lock_path.write_bytes(lock_before)
+            print("lockfloor: write failed; pyproject.toml files and uv.lock restored", file=sys.stderr)
+
+
+def render_table(rows: list[Row], *, show_member: bool) -> str:
+    header = (["member"] if show_member else []) + ["group", "package", "old", "new", "note"]
+    lines = [header]
+    for row in rows:
+        if not row.raises and not row.verdict.skip:
+            continue
+        old = split_name(row.slot.raw)[1].strip()
+        new = split_name(row.verdict.new)[1].strip() if row.verdict.new else "-"
+        note = row.verdict.skip or row.note
+        if row.verdict.skip:
+            note = f"skipped: {note}"
+        cells = ([row.slot.manifest.label] if show_member else []) + [row.slot.group_label, row.package, old, new, note]
+        lines.append(cells)
+    if len(lines) == 1:
+        return "Every floor already matches the resolved lock."
+    widths = [max(len(line[i]) for line in lines) for i in range(len(header))]
+    rendered = ["  ".join(cell.ljust(w) for cell, w in zip(line, widths)).rstrip() for line in lines]
+    rendered.insert(1, "  ".join("-" * w for w in widths))
+    return "\n".join(rendered)

lockfloor/lockfile.py

@@ -0,0 +1,146 @@
+"""Read the versions uv's resolver chose from uv.lock, per project and dependency group.
+
+A package can appear in uv.lock at several versions when the resolver forks on
+markers (numpy 2.0.2 for Python 3.9, numpy 2.3.x for 3.11+). Collapsing the lock
+into one version per name, as the copy-paste scripts do, raises the floor to a
+version some supported environment cannot install.
+"""
+
+from __future__ import annotations
+
+import tomllib
+from dataclasses import dataclass
+from itertools import product
+
+from packaging.markers import Marker
+from packaging.specifiers import SpecifierSet
+from packaging.utils import canonicalize_name
+from packaging.version import Version
+
+_PYTHON_MINORS = range(8, 16)
+_PLATFORMS = (
+    {"sys_platform": "linux", "platform_system": "Linux", "os_name": "posix", "platform_machine": "x86_64"},
+    {"sys_platform": "linux", "platform_system": "Linux", "os_name": "posix", "platform_machine": "aarch64"},
+    {"sys_platform": "darwin", "platform_system": "Darwin", "os_name": "posix", "platform_machine": "arm64"},
+    {"sys_platform": "darwin", "platform_system": "Darwin", "os_name": "posix", "platform_machine": "x86_64"},
+    {"sys_platform": "win32", "platform_system": "Windows", "os_name": "nt", "platform_machine": "AMD64"},
+)
+_PROJECT_SOURCES = ("editable", "virtual")
+
+
+@dataclass(frozen=True)
+class Locked:
+    """One version the resolver picked for a dependency edge."""
+
+    version: Version | None
+    marker: str | None
+    source_kind: str
+
+    @property
+    def from_registry(self) -> bool:
+        return self.source_kind == "registry"
+
+
+class LockIndex:
+    def __init__(self, text: str) -> None:
+        data = tomllib.loads(text)
+        self._by_name: dict[str, list[dict]] = {}
+        for package in data.get("package", []):
+            self._by_name.setdefault(canonicalize_name(package["name"]), []).append(package)
+        requires_python = SpecifierSet(data.get("requires-python", ""))
+        self._environments = [
+            env for env in _sample_environments() if requires_python.contains(env["python_full_version"])
+        ]
+
+    def resolved(self, project: str | None, section: str, group: str | None, dependency: str) -> list[Locked]:
+        """Versions locked for `dependency` along the edges of one project's group.
+
+        `section` is "main", "extra" or "group". Falls back to every locked version of
+        the name when the project or edge is absent (a virtual workspace root keeps its
+        groups in [manifest], which carries specifiers, not resolved edges).
+        """
+        name = canonicalize_name(dependency)
+        edges = self._edges(project, section, group, name)
+        if not edges:
+            return [_locked(package, None) for package in self._by_name.get(name, [])]
+        picked: list[Locked] = []
+        for edge in edges:
+            candidates = self._by_name.get(name, [])
+            if "version" in edge:
+                candidates = [p for p in candidates if p.get("version") == edge["version"]]
+            picked.extend(_locked(package, edge.get("marker")) for package in candidates)
+        return picked
+
+    def applicable(self, locked: list[Locked], requirement_marker: Marker | None) -> list[Locked]:
+        """Keep the forks whose marker can hold together with the requirement's marker.
+
+        Overlap is tested on a grid of real environments (CPython 3.8 to 3.15 on five
+        platforms) inside the lock's requires-python. When the grid proves nothing,
+        every fork is kept: the caller takes the minimum, so keeping more only lowers
+        the floor, never raises it past what an environment can install.
+        """
+        if requirement_marker is None or len(locked) < 2:
+            return locked
+        kept = [
+            entry
+            for entry in locked
+            if any(
+                requirement_marker.evaluate(env) and (entry.marker is None or Marker(entry.marker).evaluate(env))
+                for env in self._environments
+            )
+        ]
+        return kept or locked
+
+    def _edges(self, project: str | None, section: str, group: str | None, name: str) -> list[dict]:
+        if project is None:
+            return []
+        owners = [
+            p
+            for p in self._by_name.get(canonicalize_name(project), [])
+            if any(kind in p.get("source", {}) for kind in _PROJECT_SOURCES)
+        ]
+        if not owners:
+            return []
+        owner = owners[0]
+        if section == "main":
+            edges = owner.get("dependencies", [])
+        elif section == "extra":
+            edges = _group_table(owner.get("optional-dependencies", {}), group)
+        else:
+            edges = _group_table(owner.get("dev-dependencies", {}), group)
+        return [edge for edge in edges if canonicalize_name(edge["name"]) == name]
+
+
+def _group_table(table: dict, group: str | None) -> list[dict]:
+    wanted = canonicalize_name(group or "")
+    for key, edges in table.items():
+        if canonicalize_name(key) == wanted:
+            return edges
+    return []
+
+
+def _locked(package: dict, marker: str | None) -> Locked:
+    source = package.get("source", {})
+    kind = next(iter(source), "unknown")
+    version = package.get("version")
+    return Locked(Version(version) if version else None, marker, kind)
+
+
+def _sample_environments() -> list[dict[str, str]]:
+    environments = []
+    for minor, platform in product(_PYTHON_MINORS, _PLATFORMS):
+        full = f"3.{minor}.0"
+        environments.append(
+            {
+                **platform,
+                "python_version": f"3.{minor}",
+                "python_full_version": full,
+                "implementation_name": "cpython",
+                "implementation_version": full,
+                "platform_python_implementation": "CPython",
+                "platform_release": "",
+                "platform_version": "",
+                "extra": "",
+            }
+        )
+    return environments

lockfloor/manifest.py

@@ -0,0 +1,145 @@
+"""Find the workspace's pyproject.toml files and every requirement array in them.
+
+Files are parsed with tomlkit and kept as documents, so a write changes only the
+strings that were raised; comments, ordering and quote style survive.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import tomllib
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import tomlkit
+from tomlkit.items import Array, String, StringType
+from tomlkit.toml_document import TOMLDocument
+
+MAX_MANIFEST_BYTES = 1 << 20
+
+
+class ProjectError(Exception):
+    """The directory is not a project lockfloor can work on."""
+
+
+@dataclass
+class Manifest:
+    path: Path
+    original: bytes
+    document: TOMLDocument
+    project_name: str | None
+    label: str
+
+    def dump(self) -> bytes:
+        return tomlkit.dumps(self.document).encode("utf-8")
+
+
+@dataclass
+class Slot:
+    """One requirement string at a fixed position inside a manifest array."""
+
+    manifest: Manifest
+    section: str  # "main", "extra" or "group"
+    group: str | None
+    array: Array
+    index: int
+    raw: str = field(init=False)
+
+    def __post_init__(self) -> None:
+        self.raw = str(self.array[self.index])
+
+    @property
+    def group_label(self) -> str:
+        if self.section == "main":
+            return "main"
+        if self.section == "extra":
+            return f"extra:{self.group}"
+        return self.group or ""
+
+    def replace(self, new_raw: str) -> None:
+        old = self.array[self.index]
+        literal = isinstance(old, String) and old.type in (StringType.SLL, StringType.MLL)
+        self.array[self.index] = tomlkit.string(new_raw, literal=literal)
+        self.raw = new_raw
+
+
+def load_manifest(path: Path, root: Path) -> Manifest:
+    size = path.stat().st_size
+    if size > MAX_MANIFEST_BYTES:
+        raise ProjectError(f"{path}: {size} bytes exceeds the {MAX_MANIFEST_BYTES}-byte limit for pyproject.toml")
+    original = path.read_bytes()
+    try:
+        document = tomlkit.parse(original.decode("utf-8"))
+    except ValueError as exc:  # tomlkit's ParseError and UnicodeDecodeError both derive from it
+        raise ProjectError(f"{path}: not valid TOML ({exc})") from exc
+    project = document.get("project") or {}
+    name = project.get("name")
+    relative = path.parent.relative_to(root).as_posix()
+    label = str(name) if name else ("(root)" if relative == "." else relative)
+    return Manifest(path, original, document, str(name) if name else None, label)
+
+
+def find_workspace_root(start: Path) -> Path:
+    """The directory holding uv.lock: the nearest workspace that lists `start`, or `start`."""
+    start = start.resolve()
+    for directory in (start, *start.parents):
+        workspace = _workspace_table(directory / "pyproject.toml")
+        if workspace is not None and (directory == start or start in _member_dirs(directory, workspace)):
+            return directory
+    if not (start / "pyproject.toml").is_file():
+        raise ProjectError(f"no pyproject.toml in {start}")
+    return start
+
+
+def workspace_manifests(root: Path) -> list[Manifest]:
+    paths = [root / "pyproject.toml"]
+    workspace = _workspace_table(root / "pyproject.toml")
+    if workspace is not None:
+        paths += [d / "pyproject.toml" for d in _member_dirs(root, workspace) if d != root]
+    return [load_manifest(p, root) for p in paths]
+
+
+def requirement_slots(manifest: Manifest) -> list[Slot]:
+    document = manifest.document
+    project = document.get("project") or {}
+    tool_uv = (document.get("tool") or {}).get("uv") or {}
+    arrays: list[tuple[str, str | None, object]] = [("main", None, project.get("dependencies"))]
+    arrays += [("extra", k, v) for k, v in (project.get("optional-dependencies") or {}).items()]
+    arrays += [("group", k, v) for k, v in (document.get("dependency-groups") or {}).items()]
+    # uv's pre-PEP 735 spelling; the lock files it under the same "dev" group.
+    arrays.append(("group", "dev", tool_uv.get("dev-dependencies")))
+
+    slots = []
+    for section, group, array in arrays:
+        if not isinstance(array, Array):
+            continue
+        for index, item in enumerate(array):
+            # dependency-groups may hold {include-group = "..."} tables; those are not requirements.
+            if isinstance(item, str):
+                slots.append(Slot(manifest, section, group, array, index))
+    return slots
+
+
+def _workspace_table(pyproject: Path) -> dict | None:
+    if not pyproject.is_file():
+        return None
+    try:
+        data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
+    except (tomllib.TOMLDecodeError, UnicodeDecodeError) as exc:
+        raise ProjectError(f"{pyproject}: not valid TOML ({exc})") from exc
+    return data.get("tool", {}).get("uv", {}).get("workspace")
+
+
+def _member_dirs(root: Path, workspace: dict) -> list[Path]:
+    excludes = workspace.get("exclude", [])
+    members: list[Path] = []
+    if (root / "pyproject.toml").is_file():
+        members.append(root)
+    for pattern in workspace.get("members", []):
+        for candidate in sorted(root.glob(pattern)):
+            relative = candidate.relative_to(root).as_posix()
+            if any(fnmatch.fnmatch(relative, ex) for ex in excludes):
+                continue
+            if (candidate / "pyproject.toml").is_file() and candidate.resolve() not in members:
+                members.append(candidate.resolve())
+    return members

lockfloor/plan.py

@@ -0,0 +1,68 @@
+"""Pair every selected requirement with the version uv locked for it and decide its fate."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from packaging.requirements import Requirement
+
+from lockfloor.lockfile import LockIndex
+from lockfloor.manifest import Slot
+from lockfloor.specifier import Verdict, raise_floor, static_skip
+
+_SOURCE_REASONS = {
+    "editable": "workspace member or editable path; not a registry version",
+    "virtual": "workspace member; not a registry version",
+    "git": "locked from a git source",
+    "path": "locked from a local path",
+    "directory": "locked from a local directory",
+    "url": "locked from a direct url",
+}
+
+
+@dataclass
+class Row:
+    slot: Slot
+    package: str
+    verdict: Verdict
+    note: str = ""
+
+    @property
+    def raises(self) -> bool:
+        return self.verdict.new is not None
+
+
+def plan_rows(slots: list[Slot], index: LockIndex, *, pins: bool) -> list[Row]:
+    return [_plan_one(slot, index, pins=pins) for slot in slots]
+
+
+def _plan_one(slot: Slot, index: LockIndex, *, pins: bool) -> Row:
+    reason = static_skip(slot.raw, pins=pins)
+    if reason:
+        return Row(slot, _display_name(slot.raw), Verdict(skip=reason))
+    requirement = Requirement(slot.raw)
+    locked = index.resolved(slot.manifest.project_name, slot.section, slot.group, requirement.name)
+    locked = index.applicable(locked, requirement.marker)
+    if not locked:
+        return Row(slot, requirement.name, Verdict(skip="not in uv.lock (marker matches no environment?)"))
+    foreign = next((entry for entry in locked if not entry.from_registry), None)
+    if foreign is not None:
+        reason = _SOURCE_REASONS.get(foreign.source_kind, f"locked from a {foreign.source_kind} source")
+        return Row(slot, requirement.name, Verdict(skip=reason))
+
+    versions = sorted({entry.version for entry in locked if entry.version is not None})
+    if not versions:
+        return Row(slot, requirement.name, Verdict(skip="uv.lock records no version for it"))
+    # Every fork must still satisfy the new floor, so the floor is the lowest fork.
+    floor = versions[0]
+    note = ""
+    if len(versions) > 1:
+        note = f"resolver forked ({', '.join(map(str, versions))}); floor set to the lowest"
+    return Row(slot, requirement.name, raise_floor(slot.raw, floor, pins=pins), note)
+
+
+def _display_name(raw: str) -> str:
+    try:
+        return Requirement(raw).name
+    except ValueError:
+        return raw.strip()

lockfloor/resolver.py

@@ -0,0 +1,95 @@
+"""Run uv's resolver without touching the user's files.
+
+The upgrade lock is produced in a scratch copy of the workspace, so a dry run is
+byte-identical even if the process is killed half way. The copy is a sibling of the
+workspace when any path source climbs out of it (`../shared`), so those relative
+paths still resolve from the copy.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import shutil
+import subprocess
+import tempfile
+from collections.abc import Callable
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+MAX_COPY_BYTES = 512 << 20
+_NOT_COPIED = shutil.ignore_patterns(
+    ".git", ".hg", ".venv", "venv", "node_modules", "__pycache__",
+    ".mypy_cache", ".pytest_cache", ".ruff_cache", ".tox", ".nox",
+)
+
+
+class ResolveError(Exception):
+    """uv could not produce a lock; the message carries uv's own explanation."""
+
+
+class UvResolver:
+    def __init__(self, timeout: float) -> None:
+        self.timeout = timeout
+        self.exe = os.environ.get("UV") or shutil.which("uv")
+        if not self.exe:
+            raise ResolveError("uv was not found on PATH; install it from https://docs.astral.sh/uv/")
+
+    def upgraded_lock(
+        self,
+        root: Path,
+        upgrade: list[str] | None,
+        prepare: Callable[[Path], None],
+        escapes_root: bool,
+    ) -> str:
+        """Lock a scratch copy of `root` with upgrades allowed and return the new uv.lock text.
+
+        `upgrade` None means every package; otherwise only those names move.
+        `prepare` edits the copy before locking (loosening pins for --pins).
+        """
+        parent = root.parent if escapes_root else None
+        # The scratch directory is the copy itself, so it sits at the workspace's depth
+        # and `../shared` from the copy names the same directory as from the original.
+        scratch = Path(tempfile.mkdtemp(prefix=".lockfloor-", dir=parent))
+        try:
+            _copy_capped(root, scratch)
+            prepare(scratch)
+            flags = ["--upgrade"] if upgrade is None else [f"--upgrade-package={name}" for name in upgrade]
+            self._run(["lock", *flags], scratch)
+            return (scratch / "uv.lock").read_bytes().decode("utf-8")
+        finally:
+            shutil.rmtree(scratch, ignore_errors=True)
+
+    def relock(self, root: Path) -> None:
+        """Bring uv.lock's recorded requirements in line with the rewritten manifests."""
+        self._run(["lock"], root)
+
+    def _run(self, args: list[str], cwd: Path) -> None:
+        command = [self.exe, *args, "--no-progress", "--color", "never"]
+        logger.debug("running %s in %s", command, cwd)
+        try:
+            completed = subprocess.run(
+                command, cwd=cwd, capture_output=True, text=True, encoding="utf-8", timeout=self.timeout
+            )
+        except subprocess.TimeoutExpired as exc:
+            raise ResolveError(f"`uv {' '.join(args)}` exceeded the {self.timeout:g}s timeout") from exc
+        if completed.returncode != 0:
+            tail = "\n".join(completed.stderr.strip().splitlines()[-25:])
+            raise ResolveError(f"`uv {' '.join(args)}` failed:\n{tail}")
+
+
+def _copy_capped(source: Path, destination: Path) -> None:
+    copied = 0
+
+    def copy_file(src: str, dst: str) -> str:
+        nonlocal copied
+        copied += os.path.getsize(src)
+        if copied > MAX_COPY_BYTES:
+            raise ResolveError(
+                f"workspace copy passed {MAX_COPY_BYTES >> 20} MiB; move large data out of {source} "
+                "or into an ignored directory (.venv, node_modules)"
+            )
+        return shutil.copy2(src, dst)
+
+    shutil.copytree(source, destination, ignore=_NOT_COPIED, copy_function=copy_file, symlinks=True, dirs_exist_ok=True)

lockfloor/specifier.py

@@ -0,0 +1,127 @@
+"""Rewrite one requirement string so its lower bound equals a resolved version.
+
+The rewrite is textual: only the version digits of the lower-bound clause change,
+so spacing, extras, markers and quoting inside the string stay as the author wrote them.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+from packaging.requirements import InvalidRequirement, Requirement
+from packaging.specifiers import Specifier, SpecifierSet
+from packaging.version import Version
+
+_NAME_AND_EXTRAS = re.compile(
+    r"^\s*[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?\s*(?:\[[^\]]*\])?"
+)
+_CLAUSE = re.compile(r"(~=|===|==|!=|<=|>=|<|>)(\s*)([^\s,;()]+)")
+
+
+@dataclass(frozen=True)
+class Verdict:
+    """What lockfloor will do with one requirement.
+
+    Exactly one of `new` (raise to this text) and `skip` (reason it is left alone) is
+    set, or neither when the lower bound already equals the resolved version.
+    """
+
+    new: str | None = None
+    skip: str | None = None
+
+
+def split_name(raw: str) -> tuple[str, str]:
+    """Split a requirement into (name with extras, everything after it)."""
+    match = _NAME_AND_EXTRAS.match(raw)
+    if match is None:
+        return raw, ""
+    return raw[: match.end()], raw[match.end() :]
+
+
+def static_skip(raw: str, *, pins: bool) -> str | None:
+    """Reason to leave a requirement alone that does not depend on the lock, or None."""
+    try:
+        req = Requirement(raw)
+    except InvalidRequirement:
+        return "not a valid PEP 508 requirement"
+    if req.url:
+        return "direct reference (url, git or path); not a registry version"
+    clauses = list(req.specifier)
+    if not clauses:
+        return "no version specifier; lockfloor does not invent one"
+    if any(c.operator == "===" for c in clauses):
+        return "=== arbitrary-equality pin"
+    pinned = [c for c in clauses if c.operator == "=="]
+    if pinned:
+        if not pins:
+            return "pinned with ==; pass --pins to move pins"
+        if len(clauses) != 1 or "*" in pinned[0].version:
+            return "== wildcard or == combined with other clauses"
+        return None
+    lower = [c for c in clauses if c.operator in (">=", "~=", ">")]
+    if not lower:
+        return "no lower bound to raise (only upper bounds or exclusions)"
+    if len(lower) > 1:
+        return "more than one lower-bound clause"
+    if lower[0].operator == ">":
+        return "strict > bound; write it as >= to let lockfloor manage it"
+    return None
+
+
+def is_pin(raw: str) -> bool:
+    """True for a single exact `==` clause that --pins is allowed to move."""
+    try:
+        clauses = list(Requirement(raw).specifier)
+    except InvalidRequirement:
+        return False
+    return len(clauses) == 1 and clauses[0].operator == "==" and "*" not in clauses[0].version
+
+
+def loosen_pin(raw: str) -> str:
+    """Turn `pkg==1.2` into `pkg>=1.2` so the resolver may move it (temp copy only)."""
+    head, tail = split_name(raw)
+    return head + tail.replace("==", ">=", 1)
+
+
+def raise_floor(raw: str, resolved: Version, *, pins: bool) -> Verdict:
+    """Decide how `raw` changes when uv resolved its package to `resolved`."""
+    reason = static_skip(raw, pins=pins)
+    if reason:
+        return Verdict(skip=reason)
+    spec = Requirement(raw).specifier
+    floor = Version(resolved.public)
+    clauses = list(spec)
+    target = next(c for c in clauses if c.operator in ("==", ">=", "~="))
+    # A pin is checked against the loosened (>=) form the resolver actually saw.
+    declared = SpecifierSet(f">={target.version}") if target.operator == "==" else spec
+    if not declared.contains(floor, prereleases=True):
+        return Verdict(skip=f"locked {floor} is outside the declared range (stale lock?)")
+
+    old = Version(target.version)
+    if target.operator == "~=":
+        width = len(old.release)
+        new_version = ".".join(str(part) for part in floor.release[:width])
+    else:
+        new_version = str(floor)
+    if Version(new_version) <= old:
+        return Verdict()
+
+    new_raw = _replace_clause(raw, target, new_version)
+    new_spec = Requirement(new_raw).specifier
+    if not new_spec.contains(floor, prereleases=True):
+        return Verdict(skip=f"raising would exclude the locked {floor}")
+    return Verdict(new=new_raw)
+
+
+def _replace_clause(raw: str, target: Specifier, new_version: str) -> str:
+    head, tail = split_name(raw)
+    marker_at = tail.find(";")
+    region, marker = (tail, "") if marker_at < 0 else (tail[:marker_at], tail[marker_at:])
+    for match in _CLAUSE.finditer(region):
+        op, gap, version = match.groups()
+        if op == target.operator and version == target.version:
+            region = region[: match.start(3)] + new_version + region[match.end(3) :]
+            return head + region + marker
+    # packaging normalises nothing in .version, so the clause text is always found.
+    raise AssertionError(f"clause {target} not found in {raw!r}")

lockfloor-0.1.0.dist-info/METADATA

@@ -0,0 +1,142 @@
+Metadata-Version: 2.5
+Name: lockfloor
+Version: 0.1.0
+Summary: Raise pyproject.toml lower bounds to the versions uv's resolver locks together
+Project-URL: Repository, https://github.com/zaidwhy/lockfloor
+Project-URL: Issues, https://github.com/zaidwhy/lockfloor/issues
+Project-URL: uv issue, https://github.com/astral-sh/uv/issues/6794
+Author-email: Zaid Ali Syed <sidzaid72@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: dependencies,lockfile,pyproject,upgrade,uv
+Classifier: Environment :: Console
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Requires-Dist: packaging>=24.0
+Requires-Dist: tomlkit>=0.12.0
+Description-Content-Type: text/markdown
+
+# lockfloor
+
+Raise the lower bounds in `pyproject.toml` to the versions uv's resolver actually locks together.
+
+**The new floor comes from `uv lock --upgrade`, never from "latest on PyPI".** The latest release of each package, picked one by one, is a set nobody has resolved; it can be uninstallable as a whole, or uninstallable on a Python version the project still supports. lockfloor upgrades the lock in a scratch copy of the workspace, reads what uv chose from that `uv.lock`, and moves each `>=` (or `~=`) up to it. If uv cannot resolve it, lockfloor does not write it.
+
+This answers [astral-sh/uv#6794](https://github.com/astral-sh/uv/issues/6794) ("Upgrade dependencies in pyproject.toml") until uv ships its own command.
+
+```
+uvx lockfloor            # dry run: print the plan, write nothing
+uvx lockfloor --write    # rewrite pyproject.toml files, then re-lock
+uvx lockfloor --check    # exit 1 if any floor lags the lock (CI)
+```
+
+## What a run looks like
+
+The fixture in [`examples/forked-workspace`](examples/forked-workspace) is a two-member workspace with `requires-python = ">=3.9"`, an extra, a dependency group, a pin, a marker and a workspace dependency. After `uv lock`, `lockfloor` printed:
+
+```
+member     group       package    old                               new                                 note
+---------  ----------  ---------  --------------------------------  ----------------------------------  ---------------------------------------------------------------------
+demo-app   main        httpx      >=0.25,<1                         >=0.28.1,<1
+demo-app   main        numpy      >=1.24                            >=2.0.2                             resolver forked (2.0.2, 2.2.6, 2.4.6, 2.5.4); floor set to the lowest
+demo-app   main        rich       == 13.7.0                         -                                   skipped: pinned with ==; pass --pins to move pins
+demo-app   main        click      >=8.0 ; python_version >= '3.10'  >=8.5.1 ; python_version >= '3.10'
+demo-app   main        demo-core                                    -                                   skipped: no version specifier; lockfloor does not invent one
+demo-app   extra:yaml  pyyaml     >=6.0                             >=6.0.3
+demo-app   dev         pytest     >=7.0                             >=8.4.2                             resolver forked (8.4.2, 9.2.0); floor set to the lowest
+demo-app   dev         packaging                                    -                                   skipped: no version specifier; lockfloor does not invent one
+demo-core  main        attrs      >=22.1                            >=26.1.0
+demo-core  main        idna       ~=3.4                             ~=3.20
+
+7 to raise, 3 left alone, 0 already at the resolved version.
+Dry run: no file was written. Pass --write to apply and re-lock.
+```
+
+The three files hashed the same before and after. `--write` then changed only the version digits on seven lines; the comments on those lines stayed:
+
+```diff
+-    "numpy>=1.24",  # the resolver forks this one across Python versions
++    "numpy>=2.0.2",  # the resolver forks this one across Python versions
+-    "click>=8.0 ; python_version >= '3.10'",
++    "click>=8.5.1 ; python_version >= '3.10'",
+```
+
+`uv lock --check` passed afterwards, and `lockfloor --check` exited 0.
+
+## Why the lowest fork
+
+With `requires-python = ">=3.9"` uv locks numpy four times: 2.0.2 for 3.9, 2.2.6 for 3.10, 2.4.6 for 3.11, 2.5.4 for 3.12+. A tool that keeps one version per package name writes whichever it saw last. Writing `numpy>=2.5.4` into that fixture gives:
+
+```
+  × No solution found when resolving dependencies for split (markers:
+  │ python_full_version == '3.11.*'):
+  ╰─▶ Because the requested Python version (>=3.9) does not satisfy
+      Python>=3.12 and numpy==2.5.4 depends on Python>=3.12, we can conclude
+      that numpy==2.5.4 cannot be used.
+```
+
+lockfloor reads the per-edge versions uv records for each project and group, keeps the forks whose marker can hold together with the requirement's own marker (a requirement guarded by `python_version >= '3.12'` gets 2.5.4), and raises the floor to the lowest of those. Every supported environment can still install it.
+
+## What it leaves alone, and says so
+
+Every requirement it does not raise appears in the table with the reason:
+
+| Requirement | Why it is skipped |
+|---|---|
+| `rich==13.7.0` | A pin is a decision. `--pins` moves single `==` pins: the scratch copy sees `>=`, the result is written back as `==`. |
+| `rich==13.*`, `x===1.0` | Wildcard and arbitrary-equality pins are never moved. |
+| `attrs<24`, `numpy!=1.25` | No lower bound to raise. Upper bounds and exclusions are kept in every rewrite. |
+| `attrs>22` | Strict `>`; rewrite it as `>=` if lockfloor should manage it. |
+| `packaging` | No specifier. lockfloor does not invent one. |
+| `tool @ git+https://...` | Direct reference. |
+| `[tool.uv.sources]` path, git, url or workspace | Detected from the lock entry's source, not guessed from the manifest. |
+
+`~=` keeps its width so its upper edge holds: `idna~=3.4` becomes `~=3.20`, still below 4. Local labels such as `+cpu` are dropped from the floor because PEP 440 forbids them in `>=`.
+
+## Workspaces and groups
+
+lockfloor finds the workspace root from any member, reads every member's `pyproject.toml`, and covers `[project.dependencies]`, every `[project.optional-dependencies]` extra, every PEP 735 `[dependency-groups]` group (skipping `{include-group = ...}` entries) and the older `[tool.uv] dev-dependencies`.
+
+```
+lockfloor httpx numpy             # only these dependencies
+lockfloor --package demo-core     # only this workspace member
+lockfloor --group dev --group extra:yaml
+```
+
+A filtered run asks uv to upgrade only the selected names (`--upgrade-package`), so the lock moves no further than the rows shown. An unfiltered run is `uv lock --upgrade`, which also moves transitive dependencies.
+
+## How a write stays safe
+
+1. The workspace is copied to a scratch directory (without `.venv`, `.git`, caches; capped at 512 MiB) and `uv lock --upgrade` runs there. When a path source climbs out of the workspace (`../shared`), the copy is made beside the workspace so that path still resolves.
+2. Manifests are edited with tomlkit: comments, ordering, quote style and line endings survive.
+3. The scratch `uv.lock` is adopted and `uv lock` re-records the new requirements.
+4. If any step fails, every `pyproject.toml` and `uv.lock` is restored byte for byte.
+
+lockfloor itself makes no network calls; uv does all the fetching. Each uv call has a timeout (`--timeout`, default 300 s).
+
+## Exit codes
+
+`0` done or nothing to raise, `1` with `--check` when a floor can be raised, `2` on an error (uv failed, unknown `--group` or `--package`, no `pyproject.toml`).
+
+## Compared with uv-upx
+
+[uv-upx](https://github.com/Alirex/uv_upgrade) also takes versions from `uv.lock` and preserves comments. From its source at the time of writing: its lock reader keeps [one version per package name](https://github.com/Alirex/uv_upgrade/blob/main/src/uv_upx/services/dependencies_from_project/parse_from_uv_lock_file.py), so a forked package gets the last version listed, the case shown above; it raises `>=` only and [ignores `~=`](https://github.com/Alirex/uv_upgrade/blob/main/src/uv_upx/services/dependency_up/constants/operators.py); it adds `>=locked` to bare names unless told not to; and its `--help` lists no CI exit-code mode. It has an interactive accept/reject mode, which lockfloor does not.
+
+## Limits
+
+- Raising floors is what an application wants. A library that should keep supporting old releases should not run `--write` blindly; read the table.
+- Fork overlap is tested on a grid of CPython 3.8 to 3.15 on Linux (x86_64, aarch64), macOS (arm64, x86_64) and Windows. A marker on anything else (PyPy, an exotic platform) keeps every fork, which only lowers the floor.
+- `[tool.uv] constraint-dependencies` and `override-dependencies`, and `requirements.txt` files, are not touched.
+- A member whose metadata is built dynamically from git (setuptools-scm, hatch-vcs) may fail to lock in the scratch copy, which has no `.git`.
+- There is no interactive mode and no major/minor/patch filter.
+
+## Development
+
+```
+py -3.12 -m venv .venv && .venv/Scripts/python -m pip install -e . pytest
+.venv/Scripts/python -m pytest              # offline suite, fake resolver
+.venv/Scripts/python -m pytest -m network   # real uv against PyPI
+```
+
+MIT licensed.

lockfloor-0.1.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+lockfloor/__init__.py,sha256=up8ClEO0WIuyiOJyVmCojTVGhsk9LU8R7N7JeyFCGtU,109
+lockfloor/__main__.py,sha256=qwuXyEG_eNN_spVWiHPASApHT5-ye76nEGCWDYBeWXA,61
+lockfloor/cli.py,sha256=a8hGgDBf88VKZU_GvTJX3gsCfkXcGXszMs8_UDRkPlw,9440
+lockfloor/lockfile.py,sha256=zvEvqqQvPM2zPH4LPgKDvg4j4Lzd_-nqm6D3rAaSB3Q,5938
+lockfloor/manifest.py,sha256=pJ5kjm93a_MNLuzZEwV1XRIMibNUqIX7aXBKD12XSco,5542
+lockfloor/plan.py,sha256=8Ib3p6uFmnuTmw2phLuyx8rMDTRM1mG01ZAdfHsTESw,2486
+lockfloor/resolver.py,sha256=XN22HPPB2anscvgnmn4K3iYOG8hOvp-DDiMKqYISfOw,3744
+lockfloor/specifier.py,sha256=Z2chzgrKxZgtVSt7ApK5UMu24PBmMIWdhEpMjh1RH_4,4941
+lockfloor-0.1.0.dist-info/METADATA,sha256=HvzQBqKZOcraca-7IzCbTKfO0kH9wKnoKe9QlEa4MjY,9260
+lockfloor-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+lockfloor-0.1.0.dist-info/entry_points.txt,sha256=-xEh4GXyIGuL2Hw3llqN-i5oRLeMqXWCOpESDzlvSds,49
+lockfloor-0.1.0.dist-info/licenses/LICENSE,sha256=B3roCCeZDO06exjk5EZUsN6DaDNEXHFd8B54pONKgXQ,1070
+lockfloor-0.1.0.dist-info/RECORD,,

lockfloor-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

lockfloor-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+lockfloor = lockfloor.cli:main

lockfloor-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zaid Ali Syed
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.