uv locked vs frozen: the missing dependency test

说明与用途

在 CI 流水线中，uv sync --frozen 即使在 pyproject.toml 添加新依赖但 lockfile 未更新的情况下也可能成功。使用 uv sync --locked 检测不匹配，防止隐藏错误。

问题

CI may falsely pass when a new dependency is added but the lockfile is not updated, because uv sync --frozen skips the lockfile freshness check.

结果

Using uv sync --locked in CI prevents silent failures caused by stale lockfiles, ensuring that added dependencies are always reflected in the environment.

工作流

• Generate initial lockfile with uv lock
• Add a new dependency to pyproject.toml without updating the lockfile
• Run uv sync --locked to verify lockfile freshness (should fail)
• Run uv sync --frozen to see that it succeeds but the dependency is missing
• Run uv sync to update the lockfile and install the new dependency
• Run uv lock --check to confirm the updated lockfile matches the manifest

证据

uv sync --locked rejects the stale lockfile. Its bytes did not change.

来源

uv sync --frozen accepts the old lockfile. The new dependency was absent.

来源