From 5271fda410d36249b400c0de24335b0fa80eb105 Mon Sep 17 00:00:00 2001 From: Ee Durbin Date: Wed, 19 Aug 2026 10:04:25 -0400 Subject: [PATCH 1/6] Use the versions bot's ruleset bypass when merging (#27879) ## Summary Use `gh pr merge --squash --admin` when merging the versions bot's release-manifest PR. The `versions` ruleset requires human review but grants `astral-versions-bot` a pull-request-only bypass. Plain `gh pr merge` stops at its blocked-PR preflight check instead of attempting the merge with that permission. This completes the workflow-side change for https://github.com/astral-sh/github-policies/pull/31 and https://github.com/astral-sh/github-policies/pull/34. The failure was observed in https://github.com/astral-sh/versions/pull/163 ([release job](https://github.com/astral-sh/ty/actions/runs/32198672332/job/95944618373)). --- .github/workflows/publish-versions.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-versions.yml b/.github/workflows/publish-versions.yml index 44c7ca90cee165..5b25822546019a 100644 --- a/.github/workflows/publish-versions.yml +++ b/.github/workflows/publish-versions.yml @@ -78,4 +78,5 @@ jobs: run: | # Wait for PR to be created before merging sleep 10 - gh pr merge --squash "$BRANCH_NAME" + # Use admin to bypass required review + gh pr merge --squash --admin "$BRANCH_NAME" From 0680a1b01f6adafb899ebb3986d0a2b44792717c Mon Sep 17 00:00:00 2001 From: zaniebot Date: Wed, 19 Aug 2026 09:05:19 -0500 Subject: [PATCH 2/6] Require npm with dependency cooldown support (#27844) Older `npm` releases silently ignore the seven-day dependency cooldown added in #27796. Require `npm` 11.10.0 or newer in the playground, playground API, and ty benchmark projects, and enable `engine-strict` so unsupported clients fail during `npm install` or `npm ci`. The lockfile changes only record that requirement; dependency versions and the existing cooldown are unchanged. Pin Node.js to `24.19.0` for the playground CI and publishing jobs, which provides a compatible bundled `npm`. The separate script-default changes are in #27837, and the locked playground deployment tool is in #27838. Related: astral-sh/ruff#27855 pins the remaining WebAssembly test and publication runtimes. astral-sh/setup-uv#1026 and astral-sh/ruff-action#411 enforce the same legacy-aware `npm` version floor. astral-sh/uv#21193 applies it to uv's locked formatter toolchain. --------- Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- .github/workflows/publish-playground.yml | 2 +- .github/workflows/publish-ty-playground.yml | 2 +- playground/.npmrc | 1 + playground/README.md | 2 ++ playground/api/.npmrc | 1 + playground/api/package-lock.json | 3 +++ playground/api/package.json | 3 +++ playground/package-lock.json | 3 +++ playground/package.json | 3 +++ scripts/ty_benchmark/.npmrc | 1 + scripts/ty_benchmark/README.md | 1 + scripts/ty_benchmark/package-lock.json | 3 +++ scripts/ty_benchmark/package.json | 3 +++ 14 files changed, 27 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 0e721ac6a6b70e..871c90fea532eb 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1067,7 +1067,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24 + node-version: 24.19.0 cache: "npm" cache-dependency-path: playground/package-lock.json - uses: jetli/wasm-bindgen-action@20b33e20595891ab1a0ed73145d8a21fc96e7c29 # v0.2.0 diff --git a/.github/workflows/publish-playground.yml b/.github/workflows/publish-playground.yml index c083d1dd6ea792..53e54a2d5d5117 100644 --- a/.github/workflows/publish-playground.yml +++ b/.github/workflows/publish-playground.yml @@ -37,7 +37,7 @@ jobs: run: rustup target add wasm32-unknown-unknown - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24 + node-version: 24.19.0 package-manager-cache: false - uses: jetli/wasm-bindgen-action@20b33e20595891ab1a0ed73145d8a21fc96e7c29 # v0.2.0 - name: "Install Node dependencies" diff --git a/.github/workflows/publish-ty-playground.yml b/.github/workflows/publish-ty-playground.yml index 03c84b620b1682..3d210b5edb904a 100644 --- a/.github/workflows/publish-ty-playground.yml +++ b/.github/workflows/publish-ty-playground.yml @@ -40,7 +40,7 @@ jobs: run: rustup target add wasm32-unknown-unknown - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 24 + node-version: 24.19.0 package-manager-cache: false - uses: jetli/wasm-bindgen-action@20b33e20595891ab1a0ed73145d8a21fc96e7c29 # v0.2.0 - name: "Install Node dependencies" diff --git a/playground/.npmrc b/playground/.npmrc index b435032acd237a..63f6c7a89158c8 100644 --- a/playground/.npmrc +++ b/playground/.npmrc @@ -1 +1,2 @@ +engine-strict = true min-release-age = 7 diff --git a/playground/README.md b/playground/README.md index eb96b258b14766..776d91f8d10eb7 100644 --- a/playground/README.md +++ b/playground/README.md @@ -4,6 +4,8 @@ In-browser playground for Ruff. Available [https://play.ruff.rs/](https://play.r ## Getting started +Use npm 11.10.0 or newer so that the dependency cooldown in `.npmrc` is enforced. + Install the NPM dependencies with `npm ci --ignore-scripts`, and run the development server with `npm start --workspace ruff-playground` or `npm start --workspace ty-playground`. You may need to restart the server after making changes to Ruff or ty to re-build the WASM diff --git a/playground/api/.npmrc b/playground/api/.npmrc index b435032acd237a..63f6c7a89158c8 100644 --- a/playground/api/.npmrc +++ b/playground/api/.npmrc @@ -1 +1,2 @@ +engine-strict = true min-release-age = 7 diff --git a/playground/api/package-lock.json b/playground/api/package-lock.json index 14ceceb5d6160b..2a1812b5ade0b0 100644 --- a/playground/api/package-lock.json +++ b/playground/api/package-lock.json @@ -17,6 +17,9 @@ "miniflare": "^4.20260706.0", "typescript": "^7.0.0", "wrangler": "^4.107.1" + }, + "engines": { + "npm": ">=11.10.0" } }, "node_modules/@cloudflare/kv-asset-handler": { diff --git a/playground/api/package.json b/playground/api/package.json index fe3d313c7ade1e..808ba03d5d8d18 100644 --- a/playground/api/package.json +++ b/playground/api/package.json @@ -1,6 +1,9 @@ { "name": "api", "version": "0.0.0", + "engines": { + "npm": ">=11.10.0" + }, "devDependencies": { "@cloudflare/workers-types": "^5.0.0", "miniflare": "^4.20260706.0", diff --git a/playground/package-lock.json b/playground/package-lock.json index ea9c77d9a534fa..16d38db9b52841 100644 --- a/playground/package-lock.json +++ b/playground/package-lock.json @@ -29,6 +29,9 @@ "typescript-eslint": "^8.26.1", "vite": "^8.0.0", "wasm-pack": "^0.15.0" + }, + "engines": { + "npm": ">=11.10.0" } }, "node_modules/@babel/code-frame": { diff --git a/playground/package.json b/playground/package.json index ec15c9f22c4c10..bf311589fbf32d 100644 --- a/playground/package.json +++ b/playground/package.json @@ -3,6 +3,9 @@ "private": true, "version": "0.0.0", "type": "module", + "engines": { + "npm": ">=11.10.0" + }, "scripts": { "check": "npm run dev:wasm && npm run lint && npm run tsc", "dev:wasm": "npm run dev:wasm --workspace ty-playground && npm run dev:wasm --workspace ruff-playground", diff --git a/scripts/ty_benchmark/.npmrc b/scripts/ty_benchmark/.npmrc index b435032acd237a..63f6c7a89158c8 100644 --- a/scripts/ty_benchmark/.npmrc +++ b/scripts/ty_benchmark/.npmrc @@ -1 +1,2 @@ +engine-strict = true min-release-age = 7 diff --git a/scripts/ty_benchmark/README.md b/scripts/ty_benchmark/README.md index 7ec8b915f94bc2..0da4259f4e60c1 100644 --- a/scripts/ty_benchmark/README.md +++ b/scripts/ty_benchmark/README.md @@ -5,6 +5,7 @@ - Windows: `powershell -c "irm https://astral.sh/uv/install.ps1 | iex"` 1. Build ty: `cargo build --bin ty --release` 1. `cd` into the benchmark directory: `cd scripts/ty_benchmark` +1. Install npm 11.10.0 or newer, which supports the dependency cooldown in `.npmrc` 1. Install Pyright: `npm ci --ignore-scripts` 1. Run benchmarks: `uv run benchmark` diff --git a/scripts/ty_benchmark/package-lock.json b/scripts/ty_benchmark/package-lock.json index 674bef644bd5c9..5300b1cc758bd3 100644 --- a/scripts/ty_benchmark/package-lock.json +++ b/scripts/ty_benchmark/package-lock.json @@ -9,6 +9,9 @@ "version": "0.0.0", "dependencies": { "pyright": "1.1.411" + }, + "engines": { + "npm": ">=11.10.0" } }, "node_modules/fsevents": { diff --git a/scripts/ty_benchmark/package.json b/scripts/ty_benchmark/package.json index 8152ea2434bb4d..52eea38ebf4db2 100644 --- a/scripts/ty_benchmark/package.json +++ b/scripts/ty_benchmark/package.json @@ -1,6 +1,9 @@ { "name": "ty_benchmark", "version": "0.0.0", + "engines": { + "npm": ">=11.10.0" + }, "dependencies": { "pyright": "1.1.411" } From affa59be2d332eadcc50e468e55b57461e473279 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 16:28:42 +0200 Subject: [PATCH 3/6] Update dependency pytest to v9 (#27881) --- pyproject.toml | 2 +- uv.lock | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index c8ea0d8f6d3a91..fa7b645c047318 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -76,7 +76,7 @@ ruff-lsp-test = [ "packaging>=23.1", # ruff-lsp uses the pygls 1.x server API. "pygls>=1.1.0,<2", - "pytest>=7.3.1,<8", + "pytest>=9.0.3,<10", "pytest-asyncio>=0.21.2", "python-lsp-jsonrpc>=1.0.0", "typing-extensions>=4.7.1", diff --git a/uv.lock b/uv.lock index 60c73dfa0727ed..910e22c8bbd258 100644 --- a/uv.lock +++ b/uv.lock @@ -1248,17 +1248,18 @@ wheels = [ [[package]] name = "pytest" -version = "7.4.4" +version = "9.1.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "colorama", marker = "sys_platform == 'win32'" }, { name = "iniconfig" }, { name = "packaging" }, { name = "pluggy" }, + { name = "pygments" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/80/1f/9d8e98e4133ffb16c90f3b405c43e38d3abb715bb5d7a63a5a684f7e46a3/pytest-7.4.4.tar.gz", hash = "sha256:2cf0005922c6ace4a3e2ec8b4080eb0d9753fdc93107415332f50ce9e7994280", size = 1357116, upload-time = "2023-12-31T12:00:18.035Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/51/ff/f6e8b8f39e08547faece4bd80f89d5a8de68a38b2d179cc1c4490ffa3286/pytest-7.4.4-py3-none-any.whl", hash = "sha256:b090cdf5ed60bf4c45261be03239c2c1c22df034fbffe691abe93cd80cea01d8", size = 325287, upload-time = "2023-12-31T12:00:13.963Z" }, + { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" }, ] [[package]] @@ -1554,7 +1555,7 @@ ruff-lsp-test = [ { name = "lsprotocol", marker = "python_full_version >= '3.12'", specifier = ">=2023.0.0" }, { name = "packaging", marker = "python_full_version >= '3.12'", specifier = ">=23.1" }, { name = "pygls", marker = "python_full_version >= '3.12'", specifier = ">=1.1.0,<2" }, - { name = "pytest", marker = "python_full_version >= '3.12'", specifier = ">=7.3.1,<8" }, + { name = "pytest", marker = "python_full_version >= '3.12'", specifier = ">=9.0.3,<10" }, { name = "pytest-asyncio", marker = "python_full_version >= '3.12'", specifier = ">=0.21.2" }, { name = "python-lsp-jsonrpc", marker = "python_full_version >= '3.12'", specifier = ">=1.0.0" }, { name = "typing-extensions", marker = "python_full_version >= '3.12'", specifier = ">=4.7.1" }, From 6dd1fa88eb4affb69c2508524b85d7389ffbfdb4 Mon Sep 17 00:00:00 2001 From: zaniebot Date: Wed, 19 Aug 2026 09:31:32 -0500 Subject: [PATCH 4/6] Require wheels for Python tooling dependencies (#27861) Python tooling can currently build third-party source distributions. Set `no-build` in the maintained Python projects and PEP 723 scripts, retaining named exceptions for Git-pinned tooling and the local ecosystem runner. Pin the isolated build dependencies for those exceptions, including their transitive requirements. Follows merged astral-sh/ruff#27856, which gives the legacy `ruff-lsp` suite a dedicated, locked Python 3.12 test environment. Follow-up to astral-sh/ruff#27843. Replaces astral-sh/ruff#27840, which closed when the merged docs branch was deleted. Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com> --- pyproject.toml | 29 ++++++++++++++++++++ python/py-fuzzer/pyproject.toml | 12 ++++++++ python/py-fuzzer/uv.lock | 11 ++++++++ python/ruff-ecosystem/pyproject.toml | 14 ++++++++++ scripts/add_plugin.py | 1 + scripts/add_rule.py | 1 + scripts/benchmarks/pyproject.toml | 1 + scripts/build_ruff_pgo.py | 1 + scripts/bump-workspace-crate-versions.py | 1 + scripts/check_docs_formatted.py | 1 + scripts/collect_ty_ecosystem_run_metadata.py | 1 + scripts/conformance.py | 1 + scripts/ecosystem_all_check.py | 1 + scripts/generate-crate-readmes.py | 1 + scripts/generate_builtin_modules.py | 1 + scripts/generate_known_standard_library.py | 1 + scripts/generate_mkdocs.py | 1 + scripts/memory_report.py | 1 + scripts/publish-crates.py | 1 + scripts/setup-crates-io-publish.py | 1 + scripts/setup_primer_project.py | 3 ++ scripts/setup_primer_project.py.lock | 1 + scripts/transform_readme.py | 1 + scripts/ty_benchmark/pyproject.toml | 12 ++++++++ scripts/ty_benchmark/uv.lock | 11 ++++++++ scripts/update_ambiguous_characters.py | 1 + scripts/update_schemastore.py | 1 + uv.lock | 20 ++++++++++++++ 28 files changed, 132 insertions(+) diff --git a/pyproject.toml b/pyproject.toml index fa7b645c047318..141e3e7e65acfb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -92,6 +92,35 @@ typeshed-formatting = [ ] [tool.uv] +no-build = true +# CI installs the local ecosystem runner and tools pinned to Git revisions. +no-binary-package = [ + "black", + "docstring-adder", + "ecosystem-analyzer", + "mypy-primer", + "ruff-ecosystem", + "typeshed-client", +] +# Pin the isolated build environment for source-build exceptions. +build-constraint-dependencies = [ + "editables==0.6", + "hatch-fancy-pypi-readme==25.1.0", + "hatch-vcs==0.5.0", + "hatchling==1.32.0", + "packaging==26.3", + "pathspec==1.1.1", + "pluggy==1.6.0", + "setuptools==84.0.0", + "setuptools-scm==10.2.1", + "tomli==2.4.1; python_version < '3.11'", + "tomlkit==0.15.1", + "trove-classifiers==2026.6.1.19", + "typing-extensions==4.16.0; python_version < '3.11'", + "uv-build==0.12.3", + "vcs-versioning==2.2.4", + "wheel==0.47.0", +] exclude-newer = "P7D" [tool.uv.dependency-groups] diff --git a/python/py-fuzzer/pyproject.toml b/python/py-fuzzer/pyproject.toml index 1c1d6ad09819d9..ca404bda7af2dd 100644 --- a/python/py-fuzzer/pyproject.toml +++ b/python/py-fuzzer/pyproject.toml @@ -80,4 +80,16 @@ combine-as-imports = true split-on-trailing-comma = false [tool.uv] +no-build = true +no-binary-package = ["py-fuzzer"] +# Pin the isolated build environment for source-build exceptions. +build-constraint-dependencies = [ + "editables==0.6", + "hatchling==1.32.0", + "packaging==26.3", + "pathspec==1.1.1", + "pluggy==1.6.0", + "tomlkit==0.15.1", + "trove-classifiers==2026.6.1.19", +] exclude-newer = "P7D" diff --git a/python/py-fuzzer/uv.lock b/python/py-fuzzer/uv.lock index 5c47195f74b578..35aa4bf676458d 100644 --- a/python/py-fuzzer/uv.lock +++ b/python/py-fuzzer/uv.lock @@ -6,6 +6,17 @@ requires-python = ">=3.12" exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values. exclude-newer-span = "P7D" +[manifest] +build-constraints = [ + { name = "editables", specifier = "==0.6" }, + { name = "hatchling", specifier = "==1.32.0" }, + { name = "packaging", specifier = "==26.3" }, + { name = "pathspec", specifier = "==1.1.1" }, + { name = "pluggy", specifier = "==1.6.0" }, + { name = "tomlkit", specifier = "==0.15.1" }, + { name = "trove-classifiers", specifier = "==2026.6.1.19" }, +] + [[package]] name = "markdown-it-py" version = "4.0.0" diff --git a/python/ruff-ecosystem/pyproject.toml b/python/ruff-ecosystem/pyproject.toml index 8b8d2deea0d0d9..6ecc3f2a13dcbc 100644 --- a/python/ruff-ecosystem/pyproject.toml +++ b/python/ruff-ecosystem/pyproject.toml @@ -14,3 +14,17 @@ ruff-ecosystem = "ruff_ecosystem.cli:entrypoint" [tool.ruff.lint] ignore = ["T100"] preview = true + +[tool.uv] +no-build = true +no-binary-package = ["ruff-ecosystem"] +# Pin the isolated build environment for source-build exceptions. +build-constraint-dependencies = [ + "editables==0.6", + "hatchling==1.32.0", + "packaging==26.3", + "pathspec==1.1.1", + "pluggy==1.6.0", + "tomlkit==0.15.1", + "trove-classifiers==2026.6.1.19", +] diff --git a/scripts/add_plugin.py b/scripts/add_plugin.py index e64c9f5a4cf48f..d92315753ec1f2 100755 --- a/scripts/add_plugin.py +++ b/scripts/add_plugin.py @@ -5,6 +5,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/add_rule.py b/scripts/add_rule.py index 37a396c07c986d..8c3a858d2e389e 100755 --- a/scripts/add_rule.py +++ b/scripts/add_rule.py @@ -5,6 +5,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/benchmarks/pyproject.toml b/scripts/benchmarks/pyproject.toml index a9c61da3127fcd..2cab41e3fd9b19 100644 --- a/scripts/benchmarks/pyproject.toml +++ b/scripts/benchmarks/pyproject.toml @@ -25,4 +25,5 @@ linter = [ ] [tool.uv] +no-build = true exclude-newer = "P7D" diff --git a/scripts/build_ruff_pgo.py b/scripts/build_ruff_pgo.py index ae2072d41f461b..963e164b4041b4 100644 --- a/scripts/build_ruff_pgo.py +++ b/scripts/build_ruff_pgo.py @@ -5,6 +5,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/bump-workspace-crate-versions.py b/scripts/bump-workspace-crate-versions.py index 33b024d6c3482c..e308b3328a7547 100644 --- a/scripts/bump-workspace-crate-versions.py +++ b/scripts/bump-workspace-crate-versions.py @@ -10,6 +10,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/check_docs_formatted.py b/scripts/check_docs_formatted.py index 50c5448d3217a6..24c9dd60f88855 100755 --- a/scripts/check_docs_formatted.py +++ b/scripts/check_docs_formatted.py @@ -5,6 +5,7 @@ # dependencies = ["ruff"] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/collect_ty_ecosystem_run_metadata.py b/scripts/collect_ty_ecosystem_run_metadata.py index 1c24b581e0ca55..22793168e7c245 100755 --- a/scripts/collect_ty_ecosystem_run_metadata.py +++ b/scripts/collect_ty_ecosystem_run_metadata.py @@ -5,6 +5,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/conformance.py b/scripts/conformance.py index 7d347580908410..312fdda730b4c0 100644 --- a/scripts/conformance.py +++ b/scripts/conformance.py @@ -3,6 +3,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/ecosystem_all_check.py b/scripts/ecosystem_all_check.py index cbcbd4ce178cba..35dac49a395f41 100644 --- a/scripts/ecosystem_all_check.py +++ b/scripts/ecosystem_all_check.py @@ -3,6 +3,7 @@ # dependencies = ["tqdm"] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/generate-crate-readmes.py b/scripts/generate-crate-readmes.py index 38327db2181c44..899822bec0db36 100644 --- a/scripts/generate-crate-readmes.py +++ b/scripts/generate-crate-readmes.py @@ -3,6 +3,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/generate_builtin_modules.py b/scripts/generate_builtin_modules.py index a2732cfe94df31..f5ec2a05670b0d 100644 --- a/scripts/generate_builtin_modules.py +++ b/scripts/generate_builtin_modules.py @@ -3,6 +3,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/generate_known_standard_library.py b/scripts/generate_known_standard_library.py index 404a24972cc6a3..1d06524042a3f3 100644 --- a/scripts/generate_known_standard_library.py +++ b/scripts/generate_known_standard_library.py @@ -3,6 +3,7 @@ # dependencies = ["stdlibs"] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/generate_mkdocs.py b/scripts/generate_mkdocs.py index 63e35657959494..2a5a701f2ab6c9 100644 --- a/scripts/generate_mkdocs.py +++ b/scripts/generate_mkdocs.py @@ -7,6 +7,7 @@ # ] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/memory_report.py b/scripts/memory_report.py index 659a1f1aca5f3b..bd5bd73c4cc727 100644 --- a/scripts/memory_report.py +++ b/scripts/memory_report.py @@ -3,6 +3,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/publish-crates.py b/scripts/publish-crates.py index 2dbe5175c9718c..de2b21c4d43a49 100644 --- a/scripts/publish-crates.py +++ b/scripts/publish-crates.py @@ -3,6 +3,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/setup-crates-io-publish.py b/scripts/setup-crates-io-publish.py index ff7f317b467fc7..9e9171e2084768 100644 --- a/scripts/setup-crates-io-publish.py +++ b/scripts/setup-crates-io-publish.py @@ -22,6 +22,7 @@ # dependencies = ["httpx"] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/setup_primer_project.py b/scripts/setup_primer_project.py index 444f612977ea4a..2a20f6d3e7f8b9 100644 --- a/scripts/setup_primer_project.py +++ b/scripts/setup_primer_project.py @@ -5,6 +5,9 @@ # dependencies = ["mypy-primer"] # # [tool.uv] +# no-build = true +# no-binary-package = ["mypy-primer"] +# build-constraint-dependencies = ["setuptools==84.0.0"] # # This is the default for ad hoc use. Historical ecosystem reproduction must # # bypass the adjacent lock and select ecosystem-analyzer's exact mypy-primer # # revision and project Python version, as shown in the module docstring. diff --git a/scripts/setup_primer_project.py.lock b/scripts/setup_primer_project.py.lock index ccb767b3c38f3e..feef7d75fec545 100644 --- a/scripts/setup_primer_project.py.lock +++ b/scripts/setup_primer_project.py.lock @@ -7,6 +7,7 @@ exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for exclude-newer-span = "P7D" [manifest] +build-constraints = [{ name = "setuptools", specifier = "==84.0.0" }] requirements = [{ name = "mypy-primer", git = "https://github.com/hauntsaninja/mypy_primer?rev=db37f8a384c45c02fc52544fd819f979d66e174a" }] [[package]] diff --git a/scripts/transform_readme.py b/scripts/transform_readme.py index 5ba8958f72f780..58a6fdaf3aaa7d 100644 --- a/scripts/transform_readme.py +++ b/scripts/transform_readme.py @@ -3,6 +3,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/ty_benchmark/pyproject.toml b/scripts/ty_benchmark/pyproject.toml index d5e7e5a2372b5f..e73dcc0d008d53 100644 --- a/scripts/ty_benchmark/pyproject.toml +++ b/scripts/ty_benchmark/pyproject.toml @@ -37,4 +37,16 @@ division-by-zero = "error" unused-ignore-comment = "error" [tool.uv] +no-build = true +no-binary-package = ["ty-benchmark"] +# Pin the isolated build environment for source-build exceptions. +build-constraint-dependencies = [ + "editables==0.6", + "hatchling==1.32.0", + "packaging==26.3", + "pathspec==1.1.1", + "pluggy==1.6.0", + "tomlkit==0.15.1", + "trove-classifiers==2026.6.1.19", +] exclude-newer = "P7D" diff --git a/scripts/ty_benchmark/uv.lock b/scripts/ty_benchmark/uv.lock index 0214deffa34ae2..e8a4ceacf3687c 100644 --- a/scripts/ty_benchmark/uv.lock +++ b/scripts/ty_benchmark/uv.lock @@ -6,6 +6,17 @@ requires-python = ">=3.14" exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values. exclude-newer-span = "P7D" +[manifest] +build-constraints = [ + { name = "editables", specifier = "==0.6" }, + { name = "hatchling", specifier = "==1.32.0" }, + { name = "packaging", specifier = "==26.3" }, + { name = "pathspec", specifier = "==1.1.1" }, + { name = "pluggy", specifier = "==1.6.0" }, + { name = "tomlkit", specifier = "==0.15.1" }, + { name = "trove-classifiers", specifier = "==2026.6.1.19" }, +] + [[package]] name = "attrs" version = "26.1.0" diff --git a/scripts/update_ambiguous_characters.py b/scripts/update_ambiguous_characters.py index 5a5991ac2ca397..4d7c733186b2fe 100644 --- a/scripts/update_ambiguous_characters.py +++ b/scripts/update_ambiguous_characters.py @@ -3,6 +3,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/scripts/update_schemastore.py b/scripts/update_schemastore.py index d846d39ccd0d25..0a8b38d8558ab6 100644 --- a/scripts/update_schemastore.py +++ b/scripts/update_schemastore.py @@ -3,6 +3,7 @@ # dependencies = [] # # [tool.uv] +# no-build = true # exclude-newer = "P7D" # /// diff --git a/uv.lock b/uv.lock index 910e22c8bbd258..80ac9d123d7476 100644 --- a/uv.lock +++ b/uv.lock @@ -13,6 +13,26 @@ resolution-markers = [ exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values. exclude-newer-span = "P7D" +[manifest] +build-constraints = [ + { name = "editables", specifier = "==0.6" }, + { name = "hatch-fancy-pypi-readme", specifier = "==25.1.0" }, + { name = "hatch-vcs", specifier = "==0.5.0" }, + { name = "hatchling", specifier = "==1.32.0" }, + { name = "packaging", specifier = "==26.3" }, + { name = "pathspec", specifier = "==1.1.1" }, + { name = "pluggy", specifier = "==1.6.0" }, + { name = "setuptools", specifier = "==84.0.0" }, + { name = "setuptools-scm", specifier = "==10.2.1" }, + { name = "tomli", marker = "python_full_version < '3.11'", specifier = "==2.4.1" }, + { name = "tomlkit", specifier = "==0.15.1" }, + { name = "trove-classifiers", specifier = "==2026.6.1.19" }, + { name = "typing-extensions", marker = "python_full_version < '3.11'", specifier = "==4.16.0" }, + { name = "uv-build", specifier = "==0.12.3" }, + { name = "vcs-versioning", specifier = "==2.2.4" }, + { name = "wheel", specifier = "==0.47.0" }, +] + [[package]] name = "annotated-doc" version = "0.0.4" From 73ffad43aa40c983358b6c8ef244230db17c3ff2 Mon Sep 17 00:00:00 2001 From: zaniebot Date: Wed, 19 Aug 2026 09:39:35 -0500 Subject: [PATCH 5/6] Disable `npm` install scripts by default (#27837) The playground workflows disable dependency lifecycle scripts, but ordinary local installs in the playground, its API, and the ty benchmark project still enable them. Set `ignore-scripts` in each project's `.npmrc` so the same default applies outside CI, while preserving the existing seven-day release-age policy. Because `ignore-scripts` also suppresses first-party pre/post hooks, the playground's `build`, `dev:build`, and `start` commands invoke their required WASM preparation explicitly. The datastore instructions now install from the API lockfile and invoke its local Wrangler instead of allowing `npx` to resolve a separate dependency tree. Related: astral-sh/ruff-vscode#1151 and astral-sh/ty-vscode#525 apply the same install-script default to the editor extensions. astral-sh/ruff#27844 enforces the cooldown-supporting `npm` floor, astral-sh/ruff#27842 hardens the native `prek` formatter environment, and astral-sh/ruff#27838 locks the playground deployment toolchain. --------- Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- playground/.npmrc | 1 + playground/README.md | 7 +++---- playground/api/.npmrc | 1 + playground/ruff/package.json | 9 +++------ playground/ty/package.json | 9 +++------ scripts/ty_benchmark/.npmrc | 1 + 7 files changed, 13 insertions(+), 17 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 871c90fea532eb..90afa09fe53410 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1075,7 +1075,7 @@ jobs: run: npm ci --ignore-scripts working-directory: playground - name: "Build playgrounds" - run: npm run dev:wasm + run: npm run dev:build working-directory: playground - name: "Run TypeScript checks" run: npm run check diff --git a/playground/.npmrc b/playground/.npmrc index 63f6c7a89158c8..a22c5b4c3b6ca3 100644 --- a/playground/.npmrc +++ b/playground/.npmrc @@ -1,2 +1,3 @@ engine-strict = true +ignore-scripts = true min-release-age = 7 diff --git a/playground/README.md b/playground/README.md index 776d91f8d10eb7..eaffd2b189589e 100644 --- a/playground/README.md +++ b/playground/README.md @@ -13,10 +13,9 @@ module. To run the datastore, which is based on [Workers KV](https://developers.cloudflare.com/workers/runtime-apis/kv/), -install the [Wrangler CLI](https://developers.cloudflare.com/workers/wrangler/install-and-update/), -then run `npx wrangler@4.118.0 dev --local` from the `./playground/api` directory. Note that the datastore -is -only required to generate shareable URLs for code snippets. The development datastore does not +run `npm ci --ignore-scripts` and `npm start -- --local` from the `./playground/api` directory +to use the locked [Wrangler CLI](https://developers.cloudflare.com/workers/wrangler/install-and-update/). +The datastore is only required to generate shareable URLs for code snippets. The development datastore does not require Cloudflare authentication or login, but in turn only persists data locally. ## Architecture diff --git a/playground/api/.npmrc b/playground/api/.npmrc index 63f6c7a89158c8..a22c5b4c3b6ca3 100644 --- a/playground/api/.npmrc +++ b/playground/api/.npmrc @@ -1,2 +1,3 @@ engine-strict = true +ignore-scripts = true min-release-age = 7 diff --git a/playground/ruff/package.json b/playground/ruff/package.json index a89da89c4ee172..15c1b67783b18a 100644 --- a/playground/ruff/package.json +++ b/playground/ruff/package.json @@ -4,14 +4,11 @@ "version": "0.0.0", "type": "module", "scripts": { - "prebuild": "npm run build:wasm", - "build": "vite build", + "build": "npm run build:wasm && vite build", "build:wasm": "wasm-pack build ../../crates/ruff_wasm --target web --out-dir ../../playground/ruff/ruff_wasm", "dev:wasm": "wasm-pack build ../../crates/ruff_wasm --dev --target web --out-dir ../../playground/ruff/ruff_wasm", - "predev:build": "npm run dev:wasm", - "dev:build": "vite build", - "prestart": "npm run dev:wasm", - "start": "vite", + "dev:build": "npm run dev:wasm && vite build", + "start": "npm run dev:wasm && vite", "preview": "vite preview" }, "dependencies": { diff --git a/playground/ty/package.json b/playground/ty/package.json index e96e136b7997c7..c7d4ff2b2718cd 100644 --- a/playground/ty/package.json +++ b/playground/ty/package.json @@ -4,14 +4,11 @@ "version": "0.0.0", "type": "module", "scripts": { - "prebuild": "npm run build:wasm", - "build": "vite build", + "build": "npm run build:wasm && vite build", "build:wasm": "wasm-pack build ../../crates/ty_wasm --target web --out-dir ../../playground/ty/ty_wasm", "dev:wasm": "wasm-pack build ../../crates/ty_wasm --dev --target web --out-dir ../../playground/ty/ty_wasm", - "predev:build": "npm run dev:wasm", - "dev:build": "vite build", - "prestart": "npm run dev:wasm", - "start": "vite", + "dev:build": "npm run dev:wasm && vite build", + "start": "npm run dev:wasm && vite", "preview": "vite preview" }, "dependencies": { diff --git a/scripts/ty_benchmark/.npmrc b/scripts/ty_benchmark/.npmrc index 63f6c7a89158c8..a22c5b4c3b6ca3 100644 --- a/scripts/ty_benchmark/.npmrc +++ b/scripts/ty_benchmark/.npmrc @@ -1,2 +1,3 @@ engine-strict = true +ignore-scripts = true min-release-age = 7 From e53185e7705cad325217bc91076cb7405aa65836 Mon Sep 17 00:00:00 2001 From: Alex Waygood Date: Wed, 19 Aug 2026 12:55:28 +0100 Subject: [PATCH 6/6] Use simpler build backends for Python tooling --- python/py-fuzzer/pyproject.toml | 19 ++++++------------- python/py-fuzzer/uv.lock | 10 +--------- python/ruff-ecosystem/pyproject.toml | 17 ++++++----------- scripts/ty_benchmark/pyproject.toml | 20 ++++++-------------- scripts/ty_benchmark/uv.lock | 10 +--------- 5 files changed, 20 insertions(+), 56 deletions(-) diff --git a/python/py-fuzzer/pyproject.toml b/python/py-fuzzer/pyproject.toml index ca404bda7af2dd..05ab004237481a 100644 --- a/python/py-fuzzer/pyproject.toml +++ b/python/py-fuzzer/pyproject.toml @@ -1,6 +1,7 @@ [project] name = "py-fuzzer" version = "0.0.0" +description = "Run Ruff or ty on randomly generated Python source files." readme = "README.md" requires-python = ">=3.12" dependencies = [ @@ -15,14 +16,14 @@ dependencies = [ fuzz = "fuzz:main" [build-system] -requires = ["hatchling"] -build-backend = "hatchling.build" +requires = ["flit-core>=3.12,<4"] +build-backend = "flit_core.buildapi" [dependency-groups] dev = ["mypy", "ruff", "ty"] -[tool.hatch.build.targets.wheel] -include = ["fuzz.py"] +[tool.flit.module] +name = "fuzz" [tool.mypy] files = "fuzz.py" @@ -83,13 +84,5 @@ split-on-trailing-comma = false no-build = true no-binary-package = ["py-fuzzer"] # Pin the isolated build environment for source-build exceptions. -build-constraint-dependencies = [ - "editables==0.6", - "hatchling==1.32.0", - "packaging==26.3", - "pathspec==1.1.1", - "pluggy==1.6.0", - "tomlkit==0.15.1", - "trove-classifiers==2026.6.1.19", -] +build-constraint-dependencies = ["flit-core==3.12.0"] exclude-newer = "P7D" diff --git a/python/py-fuzzer/uv.lock b/python/py-fuzzer/uv.lock index 35aa4bf676458d..8d4c83ab63a529 100644 --- a/python/py-fuzzer/uv.lock +++ b/python/py-fuzzer/uv.lock @@ -7,15 +7,7 @@ exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for exclude-newer-span = "P7D" [manifest] -build-constraints = [ - { name = "editables", specifier = "==0.6" }, - { name = "hatchling", specifier = "==1.32.0" }, - { name = "packaging", specifier = "==26.3" }, - { name = "pathspec", specifier = "==1.1.1" }, - { name = "pluggy", specifier = "==1.6.0" }, - { name = "tomlkit", specifier = "==0.15.1" }, - { name = "trove-classifiers", specifier = "==2026.6.1.19" }, -] +build-constraints = [{ name = "flit-core", specifier = "==3.12.0" }] [[package]] name = "markdown-it-py" diff --git a/python/ruff-ecosystem/pyproject.toml b/python/ruff-ecosystem/pyproject.toml index 6ecc3f2a13dcbc..1a84d17d6b731f 100644 --- a/python/ruff-ecosystem/pyproject.toml +++ b/python/ruff-ecosystem/pyproject.toml @@ -1,6 +1,6 @@ [build-system] -requires = ["hatchling"] -build-backend = "hatchling.build" +requires = ["uv_build>=0.12.3,<0.13"] +build-backend = "uv_build" [project] name = "ruff-ecosystem" @@ -19,12 +19,7 @@ preview = true no-build = true no-binary-package = ["ruff-ecosystem"] # Pin the isolated build environment for source-build exceptions. -build-constraint-dependencies = [ - "editables==0.6", - "hatchling==1.32.0", - "packaging==26.3", - "pathspec==1.1.1", - "pluggy==1.6.0", - "tomlkit==0.15.1", - "trove-classifiers==2026.6.1.19", -] +build-constraint-dependencies = ["uv-build==0.12.3"] + +[tool.uv.build-backend] +module-root = "" diff --git a/scripts/ty_benchmark/pyproject.toml b/scripts/ty_benchmark/pyproject.toml index e73dcc0d008d53..8bbd4da400270a 100644 --- a/scripts/ty_benchmark/pyproject.toml +++ b/scripts/ty_benchmark/pyproject.toml @@ -20,11 +20,8 @@ dependencies = [ benchmark = "benchmark.run:main" [build-system] -requires = ["hatchling"] -build-backend = "hatchling.build" - -[tool.hatch.build.targets.wheel] -packages = ["src/benchmark"] +requires = ["uv_build>=0.12.3,<0.13"] +build-backend = "uv_build" [tool.ruff.lint] ignore = [ @@ -40,13 +37,8 @@ unused-ignore-comment = "error" no-build = true no-binary-package = ["ty-benchmark"] # Pin the isolated build environment for source-build exceptions. -build-constraint-dependencies = [ - "editables==0.6", - "hatchling==1.32.0", - "packaging==26.3", - "pathspec==1.1.1", - "pluggy==1.6.0", - "tomlkit==0.15.1", - "trove-classifiers==2026.6.1.19", -] +build-constraint-dependencies = ["uv-build==0.12.3"] exclude-newer = "P7D" + +[tool.uv.build-backend] +module-name = "benchmark" diff --git a/scripts/ty_benchmark/uv.lock b/scripts/ty_benchmark/uv.lock index e8a4ceacf3687c..ab092b57f3299e 100644 --- a/scripts/ty_benchmark/uv.lock +++ b/scripts/ty_benchmark/uv.lock @@ -7,15 +7,7 @@ exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for exclude-newer-span = "P7D" [manifest] -build-constraints = [ - { name = "editables", specifier = "==0.6" }, - { name = "hatchling", specifier = "==1.32.0" }, - { name = "packaging", specifier = "==26.3" }, - { name = "pathspec", specifier = "==1.1.1" }, - { name = "pluggy", specifier = "==1.6.0" }, - { name = "tomlkit", specifier = "==0.15.1" }, - { name = "trove-classifiers", specifier = "==2026.6.1.19" }, -] +build-constraints = [{ name = "uv-build", specifier = "==0.12.3" }] [[package]] name = "attrs"