uv-pyproject-bump 0.2.0__tar.gz

uv_pyproject_bump-0.2.0/.gitignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.pyc
+.venv/
+dist/
+build/
+*.egg-info/
+uv.lock

uv_pyproject_bump-0.2.0/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## 0.2.0
+
+- Reads `tool.uv.override-dependencies` as well, which brings the count to six tables. 0.1.0 read five, and the README wrongly said it read every table uv understands.
+- Documents that `--check` exits 0 when a bound that is behind the index is held back by an upper bound or by a second anchor. That was already true in 0.1.0 and the README said the opposite.
+- Published on PyPI under the distribution name `uv-pyproject-bump` (the `uvbump` name was taken by an unrelated project with the same normalized spelling). The command installed is still `uvbump`. The README no longer tells you to install from the git repository by default.
+
+## 0.1.0
+
+First release.
+
+- Upgrades declared version bounds in `pyproject.toml` by editing the file text, so comments, key order, quoting style and blank lines are preserved.
+- Reads `project.dependencies`, `project.optional-dependencies`, `dependency-groups`, `tool.uv.dev-dependencies` and `tool.uv.constraint-dependencies`.
+- Handles `>=`, `>`, `==`, `~=` and `==X.Y.*` bounds, keeps a compatible release clause at its original precision, and refuses to move a bound backwards.
+- Skips a dependency held back by an upper bound or an exclusion, and says which clause held it, unless `--widen`.
+- Passes over a version whose every file has been yanked, and over a requirement carrying two bounds to move.
+- `--check` for CI: writes nothing, exits 1 when a bound is behind the index.
+- `--only`, `--exclude`, `--group`, `--dry-run`, `--pre`, `--index-url`, `--no-lock`, `--quiet`.
+- Runs `uv lock` after writing when uv is on PATH.
+- No dependencies. Python 3.11 or later.

uv_pyproject_bump-0.2.0/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Younes Z.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

uv_pyproject_bump-0.2.0/PKG-INFO

@@ -0,0 +1,167 @@
+Metadata-Version: 2.5
+Name: uv-pyproject-bump
+Version: 0.2.0
+Summary: Upgrade the version bounds declared in pyproject.toml, in place, without touching comments or formatting.
+Project-URL: Homepage, https://github.com/Rezarys/uvbump
+Project-URL: Source, https://github.com/Rezarys/uvbump
+Project-URL: Issues, https://github.com/Rezarys/uvbump/issues
+Author: Younes Z.
+License-Expression: MIT
+License-File: LICENSE
+Keywords: bounds,dependencies,packaging,pyproject,upgrade,uv
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# uvbump
+
+Upgrades the version bounds declared in your `pyproject.toml`, in place, without touching your comments or your formatting. For anyone whose `pyproject.toml` still says `requests>=2.28` while the lock file has been on 2.32.5 for a year.
+
+```
+pip install uv-pyproject-bump
+uvbump --help
+```
+
+`uv lock` and `uv sync --upgrade` move your lock file. They leave the bounds you wrote in `pyproject.toml` exactly where they were, so a project can sit on `requests>=2.28` for two years while actually running 2.32.5. The usual fix is a `uv remove` then `uv add` cycle, which rewrites the file and drops every comment in it. uvbump edits the bound and nothing else.
+
+```console
+$ uvbump
+  requests           >=2.28 -> >=2.32.5
+  click              >=8.0,<9 -> >=8.1.7,<9
+  attrs              ~=23.1 -> ~=23.2
+  rich               ==13.0.0 -> ==14.0.0
+  typing-extensions  skipped: no version bound to update
+pyproject.toml: 4 bound(s) updated
+uv.lock updated
+```
+
+The diff is one line per bound. Comments, key order, quoting style and blank lines come back byte for byte.
+
+## What it reads
+
+The six tables it reads:
+
+- `project.dependencies`
+- `project.optional-dependencies.*`
+- `dependency-groups.*`
+- `tool.uv.dev-dependencies`
+- `tool.uv.constraint-dependencies`
+- `tool.uv.override-dependencies`
+
+## What it writes
+
+- `requests>=2.28`, latest 2.32.5, becomes `requests>=2.32.5`.
+- `rich==13.0.0`, latest 14.0.0, becomes `rich==14.0.0`.
+- `attrs~=23.1`, latest 23.2.0, becomes `attrs~=23.2`, kept at the same precision so the ceiling still means something.
+- `django==4.2.*`, latest 5.1.3, becomes `django==5.1.*`.
+- `click>=8.0,<9`, latest 8.1.7, becomes `click>=8.1.7,<9`.
+- `click>=8.0,<8.1`, latest 8.1.7, is left alone, and uvbump tells you the upper bound is what held it back.
+- `typing-extensions` with no bound is left alone, there is nothing to move.
+- `pkg @ https://...` is left alone, direct references are never touched.
+
+It never moves a bound backwards, and it never invents a bound you did not write. A version whose every file has been yanked is not a candidate, the same way uv and pip pass over it. Pass `--widen` if you do want the upper bound raised to the next major instead of being skipped.
+
+## Limits
+
+Worth knowing before you run it:
+
+- It reads the index, not your environment. It offers the latest release, without checking that release against your `requires-python` or against what your other dependencies allow. `uv lock` is what tells you whether the set still resolves, which is why uvbump runs it for you unless you pass `--no-lock`.
+- A requirement with two bounds to move, such as `pkg>=1.0,==2.0`, is left alone rather than guessed at.
+- Anything left alone is invisible to `--check`, which is the one to know before you put it in CI. When a bound is held back by an upper bound (`click>=8.0,<8.1`) or by a second anchor (`pkg>=1.0,==2.0`), uvbump plans no change, so `--check` exits 0 even though the declared bound is behind the index. It reports the reason on stderr either way. `--check` answers "is there a bound I can move", not "is every bound current".
+- A dependency with no bound at all stays without one. uvbump moves bounds, it does not add them.
+- Markers, extras and direct URL references are carried through untouched, never interpreted.
+- It edits `pyproject.toml` only. Your `requirements.txt` files are not its business.
+
+## In CI
+
+```yaml
+- run: uvx --from uv-pyproject-bump uvbump --check
+```
+
+`--check` writes nothing and exits 1 when it has a bound it can move forward, so a job can fail on a stale `pyproject.toml` the same way it fails on unformatted code. Exit 0 means it has nothing to move, which is not quite the same as every bound being current: read the two cases under [Limits](#limits) before you rely on it. Exit 2 means uvbump could not do its job.
+
+## Options
+
+```
+uvbump [PATH] [options]
+
+  PATH               pyproject.toml, or the directory holding it (default: ./pyproject.toml)
+  --check            write nothing, exit 1 when a bound can be moved forward
+  -n, --dry-run      show what would change, write nothing, exit 0
+  --only NAME        only this dependency, repeatable
+  --exclude NAME     never this dependency, repeatable
+  --group TABLE      only tables whose name contains this, repeatable (for example: --group dev)
+  --widen            raise an upper bound that holds a dependency back, instead of skipping it
+  --pre              consider pre-releases
+  --index-url URL    PEP 691 simple index (default: $UV_INDEX_URL, then $PIP_INDEX_URL, else PyPI)
+  --no-lock          do not run `uv lock` after writing
+  --quiet            only print what changed
+```
+
+Examples:
+
+```console
+# Two packages, nothing else.
+$ uvbump --only requests --only httpx
+
+# Dev tables only, and leave the lock file alone.
+$ uvbump --group dev --no-lock
+
+# Look first.
+$ uvbump --dry-run
+
+# A mirror or a private index.
+$ uvbump --index-url https://my.index/simple
+```
+
+## Install
+
+The distribution on PyPI is named `uv-pyproject-bump`; the command it installs is `uvbump`.
+
+```console
+$ pip install uv-pyproject-bump
+$ uvx --from uv-pyproject-bump uvbump
+```
+
+Pinning to a commit instead of the PyPI release still works:
+
+```console
+$ pip install git+https://github.com/Rezarys/uvbump@v0.2.0
+```
+
+uvbump needs Python 3.11 or later and has no dependencies. It asks your index over the PEP 691 JSON API, which means a mirror or a private index works too. It sends nothing anywhere else and collects nothing.
+
+## Why the bounds matter
+
+If you publish a library, the bounds in `pyproject.toml` are the contract your users resolve against, and a lock file does not reach them. If you ship an application, stale lower bounds quietly widen the set of resolutions your CI has never tried. Either way the file is the thing that has to be current, and it is the one thing no tool was updating.
+
+## Tests
+
+```console
+$ python3 run_tests.py
+```
+
+No test dependencies either.
+
+## Prior art
+
+`uv` itself does not do this yet, and the request is one of the most upvoted on its tracker: [astral-sh/uv#6794](https://github.com/astral-sh/uv/issues/6794) and [astral-sh/uv#1419](https://github.com/astral-sh/uv/issues/1419). Several people in those threads have published their own take, and they are worth a look if uvbump is not the shape you want.
+
+The closest match by name and by aim is [`uv-bump`](https://github.com/zundertj/uv-bump), around since February 2025: it bumps the minimum bounds in your `pyproject.toml` in sync with your `uv.lock`, keeps your formatting and your comments, and supports workspaces. It works from a clean project, and its Howto asks you for an up to date `uv.lock` and a synced `.venv` before you run it. Its README documents no check mode and no exit code for CI. uvbump reads the package index directly, so it needs neither a lock file nor a virtual environment to tell you what has moved, and `--check` is there for CI. Comments survive both tools, so that is not a reason to pick one over the other. If `uv-bump` is the shape you want, use it.
+
+If uv ships this natively, uvbump has done its job and you should use uv.
+
+Not affiliated with Astral or with the uv project.
+
+## License
+
+MIT.

uv_pyproject_bump-0.2.0/README.md

@@ -0,0 +1,143 @@
+# uvbump
+
+Upgrades the version bounds declared in your `pyproject.toml`, in place, without touching your comments or your formatting. For anyone whose `pyproject.toml` still says `requests>=2.28` while the lock file has been on 2.32.5 for a year.
+
+```
+pip install uv-pyproject-bump
+uvbump --help
+```
+
+`uv lock` and `uv sync --upgrade` move your lock file. They leave the bounds you wrote in `pyproject.toml` exactly where they were, so a project can sit on `requests>=2.28` for two years while actually running 2.32.5. The usual fix is a `uv remove` then `uv add` cycle, which rewrites the file and drops every comment in it. uvbump edits the bound and nothing else.
+
+```console
+$ uvbump
+  requests           >=2.28 -> >=2.32.5
+  click              >=8.0,<9 -> >=8.1.7,<9
+  attrs              ~=23.1 -> ~=23.2
+  rich               ==13.0.0 -> ==14.0.0
+  typing-extensions  skipped: no version bound to update
+pyproject.toml: 4 bound(s) updated
+uv.lock updated
+```
+
+The diff is one line per bound. Comments, key order, quoting style and blank lines come back byte for byte.
+
+## What it reads
+
+The six tables it reads:
+
+- `project.dependencies`
+- `project.optional-dependencies.*`
+- `dependency-groups.*`
+- `tool.uv.dev-dependencies`
+- `tool.uv.constraint-dependencies`
+- `tool.uv.override-dependencies`
+
+## What it writes
+
+- `requests>=2.28`, latest 2.32.5, becomes `requests>=2.32.5`.
+- `rich==13.0.0`, latest 14.0.0, becomes `rich==14.0.0`.
+- `attrs~=23.1`, latest 23.2.0, becomes `attrs~=23.2`, kept at the same precision so the ceiling still means something.
+- `django==4.2.*`, latest 5.1.3, becomes `django==5.1.*`.
+- `click>=8.0,<9`, latest 8.1.7, becomes `click>=8.1.7,<9`.
+- `click>=8.0,<8.1`, latest 8.1.7, is left alone, and uvbump tells you the upper bound is what held it back.
+- `typing-extensions` with no bound is left alone, there is nothing to move.
+- `pkg @ https://...` is left alone, direct references are never touched.
+
+It never moves a bound backwards, and it never invents a bound you did not write. A version whose every file has been yanked is not a candidate, the same way uv and pip pass over it. Pass `--widen` if you do want the upper bound raised to the next major instead of being skipped.
+
+## Limits
+
+Worth knowing before you run it:
+
+- It reads the index, not your environment. It offers the latest release, without checking that release against your `requires-python` or against what your other dependencies allow. `uv lock` is what tells you whether the set still resolves, which is why uvbump runs it for you unless you pass `--no-lock`.
+- A requirement with two bounds to move, such as `pkg>=1.0,==2.0`, is left alone rather than guessed at.
+- Anything left alone is invisible to `--check`, which is the one to know before you put it in CI. When a bound is held back by an upper bound (`click>=8.0,<8.1`) or by a second anchor (`pkg>=1.0,==2.0`), uvbump plans no change, so `--check` exits 0 even though the declared bound is behind the index. It reports the reason on stderr either way. `--check` answers "is there a bound I can move", not "is every bound current".
+- A dependency with no bound at all stays without one. uvbump moves bounds, it does not add them.
+- Markers, extras and direct URL references are carried through untouched, never interpreted.
+- It edits `pyproject.toml` only. Your `requirements.txt` files are not its business.
+
+## In CI
+
+```yaml
+- run: uvx --from uv-pyproject-bump uvbump --check
+```
+
+`--check` writes nothing and exits 1 when it has a bound it can move forward, so a job can fail on a stale `pyproject.toml` the same way it fails on unformatted code. Exit 0 means it has nothing to move, which is not quite the same as every bound being current: read the two cases under [Limits](#limits) before you rely on it. Exit 2 means uvbump could not do its job.
+
+## Options
+
+```
+uvbump [PATH] [options]
+
+  PATH               pyproject.toml, or the directory holding it (default: ./pyproject.toml)
+  --check            write nothing, exit 1 when a bound can be moved forward
+  -n, --dry-run      show what would change, write nothing, exit 0
+  --only NAME        only this dependency, repeatable
+  --exclude NAME     never this dependency, repeatable
+  --group TABLE      only tables whose name contains this, repeatable (for example: --group dev)
+  --widen            raise an upper bound that holds a dependency back, instead of skipping it
+  --pre              consider pre-releases
+  --index-url URL    PEP 691 simple index (default: $UV_INDEX_URL, then $PIP_INDEX_URL, else PyPI)
+  --no-lock          do not run `uv lock` after writing
+  --quiet            only print what changed
+```
+
+Examples:
+
+```console
+# Two packages, nothing else.
+$ uvbump --only requests --only httpx
+
+# Dev tables only, and leave the lock file alone.
+$ uvbump --group dev --no-lock
+
+# Look first.
+$ uvbump --dry-run
+
+# A mirror or a private index.
+$ uvbump --index-url https://my.index/simple
+```
+
+## Install
+
+The distribution on PyPI is named `uv-pyproject-bump`; the command it installs is `uvbump`.
+
+```console
+$ pip install uv-pyproject-bump
+$ uvx --from uv-pyproject-bump uvbump
+```
+
+Pinning to a commit instead of the PyPI release still works:
+
+```console
+$ pip install git+https://github.com/Rezarys/uvbump@v0.2.0
+```
+
+uvbump needs Python 3.11 or later and has no dependencies. It asks your index over the PEP 691 JSON API, which means a mirror or a private index works too. It sends nothing anywhere else and collects nothing.
+
+## Why the bounds matter
+
+If you publish a library, the bounds in `pyproject.toml` are the contract your users resolve against, and a lock file does not reach them. If you ship an application, stale lower bounds quietly widen the set of resolutions your CI has never tried. Either way the file is the thing that has to be current, and it is the one thing no tool was updating.
+
+## Tests
+
+```console
+$ python3 run_tests.py
+```
+
+No test dependencies either.
+
+## Prior art
+
+`uv` itself does not do this yet, and the request is one of the most upvoted on its tracker: [astral-sh/uv#6794](https://github.com/astral-sh/uv/issues/6794) and [astral-sh/uv#1419](https://github.com/astral-sh/uv/issues/1419). Several people in those threads have published their own take, and they are worth a look if uvbump is not the shape you want.
+
+The closest match by name and by aim is [`uv-bump`](https://github.com/zundertj/uv-bump), around since February 2025: it bumps the minimum bounds in your `pyproject.toml` in sync with your `uv.lock`, keeps your formatting and your comments, and supports workspaces. It works from a clean project, and its Howto asks you for an up to date `uv.lock` and a synced `.venv` before you run it. Its README documents no check mode and no exit code for CI. uvbump reads the package index directly, so it needs neither a lock file nor a virtual environment to tell you what has moved, and `--check` is there for CI. Comments survive both tools, so that is not a reason to pick one over the other. If `uv-bump` is the shape you want, use it.
+
+If uv ships this natively, uvbump has done its job and you should use uv.
+
+Not affiliated with Astral or with the uv project.
+
+## License
+
+MIT.

uv_pyproject_bump-0.2.0/pyproject.toml

@@ -0,0 +1,53 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "uv-pyproject-bump"
+version = "0.2.0"
+description = "Upgrade the version bounds declared in pyproject.toml, in place, without touching comments or formatting."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.11"
+authors = [{ name = "Younes Z." }]
+keywords = [
+    "pyproject",
+    "dependencies",
+    "upgrade",
+    "bounds",
+    "uv",
+    "packaging",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Software Development :: Build Tools",
+    "Typing :: Typed",
+]
+# No dependencies, on purpose: uvbump is meant to be run with `uvx` in a cold CI job.
+dependencies = []
+
+[project.scripts]
+uvbump = "uvbump.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/Rezarys/uvbump"
+Source = "https://github.com/Rezarys/uvbump"
+Issues = "https://github.com/Rezarys/uvbump/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/uvbump"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src", "tests", "README.md", "LICENSE", "CHANGELOG.md", "run_tests.py"]
+
+[tool.ruff]
+line-length = 100
+src = ["src", "tests"]

uv_pyproject_bump-0.2.0/run_tests.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+"""Run the test suite with no dependencies and no installation:
+
+    python3 run_tests.py
+
+Equivalent to `python3 -m unittest discover -s tests` with `src` on the path.
+"""
+
+import sys
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent
+sys.path.insert(0, str(ROOT / "src"))
+
+if __name__ == "__main__":
+    tests = str(ROOT / "tests")
+    suite = unittest.defaultTestLoader.discover(tests, top_level_dir=tests)
+    result = unittest.TextTestRunner(verbosity=2).run(suite)
+    sys.exit(0 if result.wasSuccessful() else 1)

uv_pyproject_bump-0.2.0/src/uvbump/__init__.py

@@ -0,0 +1,5 @@
+"""uvbump: upgrade the version bounds declared in pyproject.toml, in place."""
+
+__version__ = "0.2.0"
+
+__all__ = ["__version__"]

uv_pyproject_bump-0.2.0/src/uvbump/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

uv_pyproject_bump-0.2.0/src/uvbump/cli.py

@@ -0,0 +1,185 @@
+"""The `uvbump` command line."""
+
+from __future__ import annotations
+
+import argparse
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+from . import __version__
+from .deps import Change, RewriteError, apply, canonical_name, collect, load, plan
+from .index import DEFAULT_INDEX, IndexUnavailable, Resolver, make_resolver, resolve_all
+
+EXIT_OK = 0
+EXIT_OUTDATED = 1
+EXIT_ERROR = 2
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="uvbump",
+        description=(
+            "Upgrade the version bounds declared in pyproject.toml, in place, "
+            "without touching comments or formatting."
+        ),
+    )
+    parser.add_argument(
+        "path",
+        nargs="?",
+        default="pyproject.toml",
+        help="path to pyproject.toml, or to the directory holding it (default: ./pyproject.toml)",
+    )
+    parser.add_argument("--version", action="version", version=f"uvbump {__version__}")
+    parser.add_argument(
+        "--check",
+        action="store_true",
+        help="write nothing and exit 1 when a bound can be moved forward (for CI)",
+    )
+    parser.add_argument(
+        "-n", "--dry-run", action="store_true", help="show what would change and write nothing"
+    )
+    parser.add_argument(
+        "--only",
+        action="append",
+        default=[],
+        metavar="NAME",
+        help="only this dependency, repeatable",
+    )
+    parser.add_argument(
+        "--exclude",
+        action="append",
+        default=[],
+        metavar="NAME",
+        help="never this dependency, repeatable",
+    )
+    parser.add_argument(
+        "--group",
+        action="append",
+        default=[],
+        metavar="TABLE",
+        help="only tables whose name contains this, repeatable (for example: dev)",
+    )
+    parser.add_argument(
+        "--widen",
+        action="store_true",
+        help="raise an upper bound that holds a dependency back, instead of skipping it",
+    )
+    parser.add_argument("--pre", action="store_true", help="consider pre-releases")
+    parser.add_argument(
+        "--index-url",
+        default=os.environ.get("UV_INDEX_URL", os.environ.get("PIP_INDEX_URL", DEFAULT_INDEX)),
+        help=(
+            "PEP 691 simple index "
+            f"(default: $UV_INDEX_URL, then $PIP_INDEX_URL, else {DEFAULT_INDEX})"
+        ),
+    )
+    parser.add_argument(
+        "--no-lock", action="store_true", help="do not run `uv lock` after writing"
+    )
+    parser.add_argument("--quiet", action="store_true", help="only print what changed")
+    return parser
+
+
+def resolve_path(raw: str) -> Path:
+    path = Path(raw)
+    if path.is_dir():
+        path = path / "pyproject.toml"
+    return path
+
+
+def wanted(change_name: str, table: str, args: argparse.Namespace) -> bool:
+    name = canonical_name(change_name)
+    if args.only and name not in {canonical_name(o) for o in args.only}:
+        return False
+    if name in {canonical_name(e) for e in args.exclude}:
+        return False
+    if args.group and not any(g.lower() in table.lower() for g in args.group):
+        return False
+    return True
+
+
+def compute(text: str, args: argparse.Namespace, resolver: Resolver) -> list[Change]:
+    document = load(text)
+    requirements = [r for r in collect(document) if wanted(r.name, r.table, args)]
+    latest = resolve_all((r.name for r in requirements), resolver)
+    changes = []
+    for requirement in requirements:
+        found = latest.get(requirement.canonical)
+        if isinstance(found, IndexUnavailable):
+            changes.append(Change(requirement, None, None, str(found)))
+            continue
+        changes.append(plan(requirement, found, widen=args.widen))
+    return changes
+
+
+def report(changes: list[Change], out, quiet: bool) -> None:
+    width = max((len(c.requirement.name) for c in changes), default=0)
+    for change in changes:
+        name = change.requirement.name.ljust(width)
+        if change.bumped:
+            old = change.requirement.spec_text or "(unbounded)"
+            print(f"  {name}  {old} -> {change.new_spec}", file=out)
+        elif change.reason and not quiet:
+            print(f"  {name}  skipped: {change.reason}", file=out)
+
+
+def run_lock(path: Path, out) -> None:
+    if shutil.which("uv") is None:
+        print("uv is not on PATH, skipping `uv lock`", file=out)
+        return
+    result = subprocess.run(
+        ["uv", "lock"], cwd=path.parent or Path("."), capture_output=True, text=True
+    )
+    if result.returncode != 0:
+        print(f"`uv lock` failed:\n{result.stderr.strip()}", file=out)
+    else:
+        print("uv.lock updated", file=out)
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    out = sys.stderr if args.check else sys.stdout
+    path = resolve_path(args.path)
+    if not path.is_file():
+        print(f"no such file: {path}", file=sys.stderr)
+        return EXIT_ERROR
+
+    text = path.read_text(encoding="utf-8")
+    resolver = make_resolver(args.index_url, allow_prereleases=args.pre)
+    try:
+        changes = compute(text, args, resolver)
+    except (ValueError, OSError) as error:
+        print(f"{path}: {error}", file=sys.stderr)
+        return EXIT_ERROR
+
+    bumped = [c for c in changes if c.bumped]
+    report(changes, out, args.quiet)
+
+    if not bumped:
+        if not args.quiet:
+            print("every bound is up to date", file=out)
+        return EXIT_OK
+
+    if args.check:
+        print(f"{len(bumped)} bound(s) behind the index", file=out)
+        return EXIT_OUTDATED
+    if args.dry_run:
+        print(f"{len(bumped)} bound(s) would change, nothing written", file=out)
+        return EXIT_OK
+
+    try:
+        path.write_text(apply(text, bumped), encoding="utf-8")
+    except RewriteError as error:
+        print(f"{path}: {error}", file=sys.stderr)
+        return EXIT_ERROR
+    print(f"{path}: {len(bumped)} bound(s) updated", file=out)
+    if not args.no_lock:
+        run_lock(path, out)
+    return EXIT_OK
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())