astral-sh/uv

Force newest lock file format (revision = 3, upload-time=...)

Closed

#15,220 opened on Aug 11, 2025

View on GitHubContributor guide
 (13 comments) (3 reactions) (0 assignees)Rust (3,111 forks)batch import
enhancementgood first issue

Repository metrics

Stars
 (84,934 stars)
PR merge metrics
 (Avg merge 7d 16h) (259 merged PRs in 30d)

Description

Summary

We use uv lock as a pre-commit hook, with the newest version of uv specified in pre-commit-config.yaml.

However, we still keep getting different versions of uv.lock, depending on which developer pc which local uv version was most recently used to add a library. This causes many unrelated changes in the diff for uv.lock, because older uv versions apparently remove e.g. the upload-time=... sections from all hashes.

The uv lock from the pre-commit hook, which is version-pinned, and should always be the correct version, apparently does not rewrite the lock file, even if the format.revision do not match.

Is there a way to force uv lock to also check the format and revision of the lock file?

The workaround I found is e.g. uv add my-test-package && uv remove my-test-package, which seems like a terrible hack.

Example

uv lock --force -> Rewrite lock file in the newest format, adding revision = 3, upload-time=... for all hashes.

Example of a uv.lock diff that resulted from commits by different developers, not detected by uv lock

--- a/uv.lock
+++ b/uv.lock
@@ -1,4 +1,5 @@
 version = 1
+revision = 3
 requires-python = ">=3.10"
 resolution-markers = [
     "python_full_version >= '3.12.4' and sys_platform != 'win32'",
@@ -24,9 +25,9 @@ members = [
 name = "aiohappyeyeballs"
 version = "2.4.6"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/08/07/508f9ebba367fc3370162e53a3cfd12f5652ad79f0e0bfdf9f9847c6f159/aiohappyeyeballs-2.4.6.tar.gz", hash = "sha256:9b05052f9042985d32ecbe4b59a77ae19c006a78f1344d7fdad69d28ded3d0b0", size = 21726 }
+sdist = { url = "https://files.pythonhosted.org/packages/08/07/508f9ebba367fc3370162e53a3cfd12f5652ad79f0e0bfdf9f9847c6f159/aiohappyeyeballs-2.4.6.tar.gz", hash = "sha256:9b05052f9042985d32ecbe4b59a77ae19c006a78f1344d7fdad69d28ded3d0b0", size = 21726, upload-time = "2025-02-07T17:53:12.277Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/44/4c/03fb05f56551828ec67ceb3665e5dc51638042d204983a03b0a1541475b6/aiohappyeyeballs-2.4.6-py3-none-any.whl", hash = "sha256:147ec992cf873d74f5062644332c539fcd42956dc69453fe5204195e560517e1", size = 14543 },
+    { url = "https://files.pythonhosted.org/packages/44/4c/03fb05f56551828ec67ceb3665e5dc51638042d204983a03b0a1541475b6/aiohappyeyeballs-2.4.6-py3-none-any.whl", hash = "sha256:147ec992cf873d74f5062644332c539fcd42956dc69453fe5204195e560517e1", size = 14543, upload-time = "2025-02-07T17:53:10.304Z" },
 ]

Contributor guide

Research direction
The implementation likely involves adding a ` force` flag to the `lock` command in the CLI. The lock file writing logic in `crates/uv/src/lock.rs` or similar should be modified to ignore existing format and always write the newest revision. Ensure that the version and revision fields are updated, and all package entries have `upload time` attributes. Review existing discussion in issue #15220 for potential edge cases.
Tech stack
rustpython
Domain
clideveloper experience
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Rust programmingUnderstanding of uv lock file format
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70