uv locked vs frozen: the missing dependency test

Описание и применение

В CI‑пайплайне uv sync --frozen может успешно завершиться, даже если в pyproject.toml добавлена новая зависимость, но lockfile не обновлен. Используйте uv sync --locked, чтобы обнаружить несоответствие и предотвратить скрытые ошибки.

Задача

CI may falsely pass when a new dependency is added but the lockfile is not updated, because uv sync --frozen skips the lockfile freshness check.

Результат

Using uv sync --locked in CI prevents silent failures caused by stale lockfiles, ensuring that added dependencies are always reflected in the environment.

Рабочий процесс

• Generate initial lockfile with uv lock
• Add a new dependency to pyproject.toml without updating the lockfile
• Run uv sync --locked to verify lockfile freshness (should fail)
• Run uv sync --frozen to see that it succeeds but the dependency is missing
• Run uv sync to update the lockfile and install the new dependency
• Run uv lock --check to confirm the updated lockfile matches the manifest

Доказательства

uv sync --locked rejects the stale lockfile. Its bytes did not change.

Источник

uv sync --frozen accepts the old lockfile. The new dependency was absent.

Источник