cproudlock 76d34a4b25 Keep the lockfile's rationale where a compile cannot wipe it ...

requirements.txt carried a hand-written header explaining why the lockfile is
universal and hashed, what each flag buys, and a warning not to hand-edit it
because waitress and tzdata were once added by hand and vanished on the next
compile.

Running `uv pip compile` to upgrade two packages wiped all of it, including the
warning about hand-edits vanishing. The header had been documenting its own
failure mode and still lost.

The explanation now lives in requirements.in, which is the file people edit and
which a compile never rewrites. The header is restored in requirements.txt for
anyone reading that file directly, but it is no longer the only copy.

Also records the --upgrade-package form for moving one package without moving
everything else, and the scan_sbom.py check to run before a release.

2026-08-29 17:42:43 -04:00

2.3 KiB

Raw Blame History

View Raw