Skip to content

fix: don't mutate cached parsed_pipfile when locking deps#6657

Merged
matteius merged 2 commits intomainfrom
fix/pipfile-cache-mutation-on-lock
Apr 28, 2026
Merged

fix: don't mutate cached parsed_pipfile when locking deps#6657
matteius merged 2 commits intomainfrom
fix/pipfile-cache-mutation-on-lock

Conversation

@matteius
Copy link
Copy Markdown
Member

Summary

  • get_locked_dep was popping version/ref off the entry it received from pipfile_section. Since perf: cache Pipfile parse, parallelize hash/candidate lookups, harden benchmark runner #6649 made parsed_pipfile return a cached TOMLDocument by reference, those pops persisted for the rest of the invocation — a follow-up write_toml (e.g. when add_pipfile_entry_to_pipfile adds the newly installed package) would emit six = {} and strip the version from sibling inline/outline-table entries.
  • Copy the dict before scrubbing those keys.
  • Add a unit regression test that asserts get_locked_dep leaves the section untouched.

This fixes the integration regression that made test_rewrite_outline_table and test_rewrite_outline_table_ooo start failing on every CI run since the pip 26.1 vendor PR (#6656) merged. (The cache-by-reference change in #6649 introduced the latent bug; #6656 is just when it became consistently observable.)

Test plan

  • New unit test tests/unit/test_locking_no_mutation.py fails on main and passes with this fix
  • Local repro: pipenv install colorama against a Pipfile with six = {version = "*"} and [packages.requests] now preserves both entries' versions instead of producing six = {} / requests = {extras = ["socks"]}
  • CI green on test_rewrite_outline_table / test_rewrite_outline_table_ooo

Notes on other CI failures (not in scope here)

  • test_install_with_pipfile_including_invalid_python_version — stale; pipenv now supports PEP 440 specifiers in python_version (feat(#5195): support PEP 440 version specifiers in Pipfile python_version #6606), so the install correctly succeeds. Test should be updated/removed separately.
  • test_install_github_vcs[*] — the reagento/adaptix.git@2.16 VCS dep no longer resolves under pip 26.1 (No matching distribution found for dataclass-factory). Needs a separate look at pip's resolvelib factory changes.

🤖 Generated with Claude Code

matteius and others added 2 commits April 27, 2026 22:53
get_locked_dep popped ``version`` and ``ref`` directly off the entry it
received from ``pipfile_section``.  Since #6649 made ``parsed_pipfile``
return a cached TOMLDocument by reference, those pops persisted across
the rest of the pipenv invocation — a subsequent ``write_toml`` (e.g.
``add_pipfile_entry_to_pipfile`` for the newly installed package) would
emit ``six = {}`` instead of ``six = {version = "*"}`` and strip the
version from any inline-table or outline-table siblings.

Copy the dict before scrubbing those keys.  Add a unit regression test
that asserts get_locked_dep leaves the section untouched.

Fixes the integration regression hit by ``test_rewrite_outline_table``
and ``test_rewrite_outline_table_ooo`` on main since the pip 26.1
vendoring run.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@matteius matteius merged commit 87dffe0 into main Apr 28, 2026
23 checks passed
@matteius matteius deleted the fix/pipfile-cache-mutation-on-lock branch April 28, 2026 11:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant