dependencies of dependencies not being updated

[hmoffatt]

I see packages in pdm.lock which are out of date, but pdm update is not updating them.

For example in pyproject.toml I have specified curlify>=2.2.1 as a dependency. This results in the following

curlify 3.0.0 [ required: >=2.2.1 ]
└── requests 2.32.5 [ required: Any ]
    ├── certifi 2025.4.26 [ required: >=2017.4.17 ]
    ├── charset-normalizer 3.4.2 [ required: <4,>=2 ]
    ├── idna 3.10 [ required: <4,>=2.5 ]
    └── urllib3 1.26.20 [ required: <3,>=1.21.1 ]

However, charset-normalizer 3.4.4 is available according to PyPi.org (https://pypi.org/project/charset-normalizer/3.4.4/) and according to Renovate. But pdm update doesn't want to install it.

The tree doesn't show anything else holding that package back either.

I created a brand new project and installed curlify there and got the later version though:

curlify 3.0.0 [ required: >=3.0.0 ]
└── requests 2.32.5 [ required: Any ]
    ├── certifi 2025.11.12 [ required: >=2017.4.17 ]
    ├── charset-normalizer 3.4.4 [ required: <4,>=2 ]
    ├── idna 3.11 [ required: <4,>=2.5 ]
    └── urllib3 2.5.0 [ required: <3,>=1.21.1 ]

Am I missing something?

[hmoffatt]

So pdm update --update-eager is what I was missing. Oops. I don't really understand why this isn't the default though.

[frostming]

--update-eager is more aggressive. In a production environment, we would prefer the pinned versions which are already working.