"cryptography==46.0.5", # was "cryptography>=41.0.5"
Root cause. uv sync is declarative: it reconciles the venv against the tracked lockfile, so any venv mutation not encoded in pyproject.toml/uv.lock is silently overwritten. Tick #133's uv pip install cryptography==46.0.5 was a board-only, venv-only change: git stayed clean, pyproject.toml still declared cryptography>=41.0.5, and uv.lock (gitignored, generated) still resolved the latest (49.0.0 then; 50.0.0 now). The next uv sync reinstalled the unpinned resolution, reverting the venv and re-introducing the ACM parity AttributeError (a legacy pyOpenSSL API — GEN_EMAIL in the incident, X509Req in the sandbox — that the newer resolution removes).
Durable fix (tick #134). Pin the version in the tracked file, in both dependency lists, then regenerate the lock and re-sync everything:
# pyproject.toml — pin in BOTH lists
[project]
dependencies = [
"cryptography==46.0.5", # was "cryptography>=41.0.5"
"pyOpenSSL>=24.0.0",
]
[project.optional-dependencies]
test = [
"pytest>=8.0",
"cryptography==46.0.5", # was "cryptography>=41.0.5"
]
# 1. regenerate uv.lock from the new pin (targeted, not a blind relock)
uv lock --upgrade-package cryptography==46.0.5 --python 3.12
# 2. apply to venv: runtime + test extras, then editable install
uv sync --all-extras --python 3.12
uv pip install -e . --python .venv/bin/python
# 3. commit — pyproject.toml is the ONLY tracked artifact that matters
git add pyproject.toml && git commit -m "pin cryptography==46.0.5 in both dependency lists; regenerate uv.lock"
Why this holds: uv.lock is gitignored (generated), so the commit's durable content is pyproject.toml. Every future uv sync (CI, other boards, the same minute) re-resolves from the tracked pin, so 46.0.5 is now the floor and ceiling — it cannot drift back to 49.0.0/50.0.0.
Reproduced end-to-end with `uv 0.11.17` / Python 3.12 in a disposable sandbox (project `acm` with runtime + `test` extra, both listing `cryptography>=41.0.5`, `uv.lock` gitignored): | Step | Result | |---|---| | 1. `uv lock` on unpinned files | `uv.lock` resolves `cryptography 50.0.0` (49.0.0 at incident time — same mechanics) | | 2. Tick #133 venv-only fix: `uv pip install cryptography==46.0.5` | venv shows 46.0.5; **`git status` clean** — zero tracked change | | 3. Next `uv sync` (the 17:39 revert) | `- cryptography==46.0.5 + cryptography==50.0.0` — regression reproduced | | 4. Parity break | `OpenSSL.crypto.X509Req` (stand-in for the incident's `GEN_EMAIL`): **`False` / AttributeError** on 50.0.0+pyOpenSSL 26.4.0; the venv-only pin alone didn't even restore it (it never re-resolves dependents — extra proof venv-only fixes are unreliable) | | 5. Durable fix applied | `pyproject.toml` pins `==46.0.5` in both lists; `uv lock --upgrade-package cryptography==46.0.5` → `Updated cryptography v50.0.0 -> v46.0.5`, `pyopenssl v26.4.0 -> v26.2.0`; sync + extras + editable → venv at 46.0.5/26.2.0; **parity probe `True`** | | 6. Re-run `uv sync` | `Checked 11 packages` — no changes, still 46.0.5 (idempotent, no revert) | | 7. Rogue re-pin attempt | `uv pip install cryptography==50.0.0` → next `uv sync` prints `- cryptography==50.0.0 + cryptography==46.0.5` — the tracked pin now governs | | 8. Tracked surface | `git status`: only `M pyproject.toml` (2 insertions/2 deletions); `uv.lock` confirmed ignored | Edge cases tested: pin present in **both** dependency lists (runtime + extra); targeted `--upgrade-package` relock vs. full relock (targeted verified); re-sync idempotency; post-fix rogue venv mutation corrected by sync; gitignored-`uv.lock` tracked-surface check (pyproject.toml is the durable pin).
{"model": "deepseek-v4-flash", "problem_class": "python-dependency-pin-regression", "result": "passed", "tests": 7}