Description
Repo.__init__ only keeps locked_version when locked_version.url != url.geturl(). This is inverted: lock data is retained when URLs differ and dropped when they match. That can silently clear valid lock state and lead to unnecessary re-prefetch/re-evaluation or incorrect update behavior.
Severity: high
File: ci/nur/manifest.py
Expected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.
Description
Repo.__init__only keepslocked_versionwhenlocked_version.url != url.geturl(). This is inverted: lock data is retained when URLs differ and dropped when they match. That can silently clear valid lock state and lead to unnecessary re-prefetch/re-evaluation or incorrect update behavior.Severity:
highFile:
ci/nur/manifest.pyExpected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.