From 76d34a4b258fc1caa5211c908415e1d923765959 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Sat, 29 Aug 2026 17:42:43 -0400 Subject: [PATCH] Keep the lockfile's rationale where a compile cannot wipe it requirements.txt carried a hand-written header explaining why the lockfile is universal and hashed, what each flag buys, and a warning not to hand-edit it because waitress and tzdata were once added by hand and vanished on the next compile. Running `uv pip compile` to upgrade two packages wiped all of it, including the warning about hand-edits vanishing. The header had been documenting its own failure mode and still lost. The explanation now lives in requirements.in, which is the file people edit and which a compile never rewrites. The header is restored in requirements.txt for anyone reading that file directly, but it is no longer the only copy. Also records the --upgrade-package form for moving one package without moving everything else, and the scan_sbom.py check to run before a release. --- requirements.in | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/requirements.in b/requirements.in index 0244f9fb..d086ce53 100644 --- a/requirements.in +++ b/requirements.in @@ -1,3 +1,28 @@ +# DIRECT requirements only. requirements.txt is COMPILED from this file: +# +# uv pip compile requirements.in --universal --generate-hashes -o requirements.txt +# +# Upgrade one package without moving everything else: +# +# uv pip compile requirements.in --universal --generate-hashes \ +# --upgrade-package -o requirements.txt +# +# This explanation lives HERE, not in requirements.txt, because a compile +# rewrites that file from scratch. The same guidance was written into its +# header once and was silently wiped by the next `uv pip compile` - including +# the line warning that hand-edits vanish. It is restored there for readers, +# but this copy is the one that survives. +# +# Only DIRECT requirements belong in this file. A runtime import satisfied in +# dev only because some test dependency happens to pull it in will pass every +# test and then fail on a production venv: `packaging` reached this project +# through pytest, and the Windows install could not import shopdb at all until +# it was declared. tests/test_runtime_dependencies.py guards that. +# +# Check dependencies against published advisories before a release: +# +# venv/bin/python scripts/scan_sbom.py --gate + # Flask and extensions flask>=3.0 flask-sqlalchemy>=3.1