Visitar URL original
fix(pep440): skip pre-releases when the pattern is a constraint by loispostula · Pull Request #10546 · updatecli/updatecli · GitHub
Skip to content

fix(pep440): skip pre-releases when the pattern is a constraint - #10546

Merged
olblak merged 1 commit into
updatecli:mainfrom
loispostula:fix/pep440-constraint-prerelease
Sep 18, 2026
Merged

fix(pep440): skip pre-releases when the pattern is a constraint#10546
olblak merged 1 commit into
updatecli:mainfrom
loispostula:fix/pep440-constraint-prerelease

Conversation

@loispostula

@loispostula loispostula commented Sep 18, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fix #10545

Pep440.Search filtered pre-releases only on the ""/"*" pattern. With a constraint pattern it returned the first specifiers.Check match, and go-pep440-version rejects a pre-release only when it shares the specifier's base version, so >=15,<16 resolved to stripe 15.7.0b1 over the stable 15.6.1.

A first pass now takes the highest matching stable. The existing loop stays untouched as the fallback for constraints that only pre-releases satisfy.

Most visible through the pyproject crawler, which reuses each dependency's own constraint as the pattern: constrained dependencies were bumped to pre-releases while unconstrained ones (pattern *) were not.

Test

To test this pull request, you can run the following commands:

cd pkg/plugins/utils/version
go test

Two cases added to the existing dataset: a constraint skipping the pre-release, and a constraint falling back to one when no stable matches.

Additional Information

Checklist

  • I have updated the documentation via pull request in website repository. Not applicable: no configuration or setting changes.
  • I have tested this pull request manually with a custom Updatecli build and it works as expected.
sources:
  stripe:
    kind: pypi
    spec:
      name: stripe
      versionfilter:
        kind: pep440
        pattern: ">=15,<16"
v0.120.1 → ✔ version "15.7.0b1" found for PyPI package "stripe"
patched  → ✔ version "15.6.1" found for PyPI package "stripe"

Same build against a pyproject.toml declaring pydantic>=2.12 and SQLAlchemy>=2.0,<3: 2.14.0b2 → 2.13.5 and 2.1.0rc2 → 2.0.54, while unconstrained idna and boto3 are unchanged.

Tradeoff

The candidate list is walked twice when no stable version satisfies the constraint. Lists are small and the second pass only runs in that case.

A constraint that names a pre-release itself (>=2.14.0b1) still prefers a matching stable, where pip would prefer the higher pre-release. That felt like the safer default for an auto-bumper, easy to flip if you disagree.

Potential improvement

The pyproject crawler could map [tool.uv] prerelease (disallow / allow) onto the generated filter. uv cannot enforce it on its own here: the generated target pins an exact version, which makes a pre-release necessary by construction.

Summary by CodeRabbit

  • Bug Fixes
    • Version constraint searches now prefer the highest matching stable release.
    • When no stable release matches, searches select the highest matching pre-release.

@loispostula
fix(pep440): skip pre-releases when the pattern is a constraint
7c392ac 
Pep440.Search only filtered pre-releases out on the "*" pattern, so a
constraint such as ">=15,<16" resolved to 15.7.0b1 while 15.6.1 was the
latest stable. Specifiers.Check accepts pre-releases, PEP 440 leaves
their exclusion to the caller.

Fixes updatecli#10545

Signed-off-by: Loïs Postula <lois@postu.la>
@coderabbitai

coderabbitai Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c560ed16-f8e1-4e96-98ba-7cf4c01a1b79

📥 Commits

Reviewing files that changed from the base of the PR and between c1f2f28 and 7c392ac.

📒 Files selected for processing (2)
  • pkg/plugins/utils/version/pep440.go
  • pkg/plugins/utils/version/pep440_test.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

The PEP 440 constraint search now selects the highest matching stable version first. If no stable version matches, it selects the highest matching pre-release. Tests cover both cases.

Changes

PEP 440 constraint handling

Layer / File(s) Summary
Stable preference and fallback coverage
pkg/plugins/utils/version/pep440.go, pkg/plugins/utils/version/pep440_test.go		 The constraint search checks stable versions before falling back to matching pre-releases. Tests cover stable selection for >=15,<16 and pre-release fallback for >2.0.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: olblak

Merge Risk: ⚪ Minimal · up to 7c392

The public search path is covered for stable preference and pre-release fallback, with no concrete merge-blocking issue identified.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the PEP 440 constraint fix and the main behavior change: avoiding pre-release selection when a stable match exists.
Description check ✅ Passed The description follows the repository template. It includes the linked issue, change details, test command, test coverage, checklist status, manual validation, tradeoffs, and potential improvement.
Linked Issues check ✅ Passed The implementation in pkg/plugins/utils/version/pep440.go adds a stable-version pass for constraint searches. It returns the first matching non-pre-release before the existing matching-version fallb…
Out of Scope Changes check ✅ Passed The pull request changes only the shared PEP 440 search implementation and its tests. These changes directly implement issue #10545 and its stated dependency-selection behavior. No unrelated productio…
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR

Comment @coderabbitai help to get the list of available commands.

@loispostula
loispostula requested a review from a team September 18, 2026 13:47
@olblak
olblak merged commit c0e2fe6 into updatecli:main Sep 18, 2026
8 checks passed
@olblak olblak added bug Something isn't working core All things related to Updatecli core engine labels Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@olblak olblak olblak approved these changes

Assignees

No one assigned

Labels

bug Something isn't working core All things related to Updatecli core engine

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

pep440 versionfilter returns a pre-release when the pattern is a constraint

2 participants

@loispostula @olblak