GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Fix pdm e2e red on every PR: pin hishel<2 by mikolalysenko · Pull Request #2028 · SocketDev/socket-patch

Conversation

@mikolalysenko

@mikolalysenko Mikola Lysenko (mikolalysenko) commented Nov 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Collaborator

Problem

hishel 2.0.0 was published to PyPI on 2026-11-05 at 14:10 UTC. Since then the required e2e (ubuntu-latest, e2e_vex_build, poetry/pdm/hatch/pipenv/deno) leg in ci.yml fails on every PR, and through ci-ok that blocks every merge:

  • Require sbt resolution evidence before attesting vendored pins #2008: https://github.com/SocketDev/socket-patch/actions/runs/42064562811/job/127376042009
  • Skip unsafe Rush subspace locks in the lock inventory #2003: https://github.com/SocketDev/socket-patch/actions/runs/42064167217/job/127375145350

Both PRs fail the same two tests with the same error. The other suites in the leg (poetry, hatch, pipenv, deno) pass:

test pdm::pdm_vendored_install_then_manifest_less_vex ... FAILED
test pdm::pdm_hosted_install_then_manifest_less_vex ... FAILED
SOCKET_PATCH_PDM_E2E_REQUIRED is set but pdm lock (PyPI) failed: exit Some(1)
[AttributeError]: module 'hishel' has no attribute 'SyncSqliteStorage'

Main is green only because nothing has merged since the release. The next merge_group run will fail too. The pdm-compatibility.yml cells for 2.26.9+ and the nightly / extended pdm legs on recent releases have the same exposure.

Root cause

PDM 2.26.9+ declare an unbounded hishel[httpx]>=1.0.0 (2.29.6 declares >=1.4.0). hishel 2.0 dropped SyncSqliteStorage, which PDM imports at startup. This is the same failure mode as the existing hishel<1 (2.21 to 2.26.0) and unearth<0.19 pins.

Fix

Pin hishel<2 when bootstrapping PDM 2.26.1+, in both crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs and scripts/backtest-pdm.py (the two pins_for copies). For 2.26.1 to 2.26.8, which already bound <1, the pin changes nothing. No test is removed or skipped.

Proof

  • Reproduced locally: pip install pdm==2.29.2 'unearth<0.19' resolves hishel 2.0.0, and pdm lock fails with the CI error. Adding 'hishel<2' resolves 1.4.0 and pdm lock succeeds.
  • SOCKET_PATCH_PDM_E2E_REQUIRED=1 SOCKET_PATCH_PDM_E2E_VERSION=2.29.2 cargo test -p socket-patch-cli --test e2e_vex_build -- pdm:: --ignored gives 2 passed, and the bootstrapped venv has hishel-1.4.0.
  • backtest-pdm.py pins_for: 2.20.1 is unchanged, 2.25.9 keeps hishel<1, and 2.26.1 / 2.29.2 add hishel<2.
  • rustfmt --check on the touched file is clean.

https://claude.ai/code/session_011f9aeNshqCtBWV4tqKmmZ6


Generated by Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@claude
Pin hishel<2 in the PDM 2.26.1+ bootstrap
6c615de
hishel 2.0.0 was published on 2026-11-05 at 14:10 UTC and removed
SyncSqliteStorage. PDM 2.26.9 and later declare an unbounded
`hishel>=1.0.0`, so a fresh bootstrap now resolves 2.0 and every
pdm command dies with "module 'hishel' has no attribute
'SyncSqliteStorage'". That turns the ci.yml e2e_vex_build leg
(pdm 2.29.2) red on every PR, and through ci-ok blocks every merge.

Pin `hishel<2` for 2.26.1+ in both the e2e harness and
scripts/backtest-pdm.py. For 2.26.1 - 2.26.8, which already bound
`<1`, the pin changes nothing. 2.21 - 2.26.0 keep `hishel<1`.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_011f9aeNshqCtBWV4tqKmmZ6
@mikolalysenko Mikola Lysenko (mikolalysenko) added the ci-janitor Opened by the CI janitor routine (flakes, redundant tests, CI perf) label Nov 5, 2026
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Nov 5, 2026

Copy link
Copy Markdown
Collaborator Author

bugbot run


Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@mikolalysenko Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Nov 5, 2026
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Nov 5, 2026

Copy link
Copy Markdown
Collaborator Author

Labeled Ready for review (burn-down agent).

  • Head: 6c615de428123b7cebeddafc0c372e81dcdf4690
  • CI: 50/50 checks green.
  • Bugbot: reviewed this head, no issues found.
  • Mergeable, no CHANGELOG.md change.
  • Slack announcement not sent this run (no Slack send tool available); the next run will retry.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

This was referenced Nov 5, 2026
Skip unsafe Rush subspace locks in the lock inventory #2003
Merged
Require sbt resolution evidence before attesting vendored pins #2008
Merged
Restore the uv 0.2 pins hosted mode writes #2014
Merged
Read Maven checksums.sha256 one way and never drop user lines #2016
Merged
Read BOM composer locks and pin that no lock pin drives a download #2017
Merged
Keep vendored artifacts a lock references through escaped paths #2022
Merged
Read the governing go.work in Go discovery #2011
Merged
@mikolalysenko
Mikola Lysenko (mikolalysenko) enabled auto-merge November 5, 2026 18:49
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Nov 5, 2026

Copy link
Copy Markdown
Collaborator Author

Final review brief (for the human approver)

What it does: hishel 2.0 (released today) removed SyncSqliteStorage, and PDM 2.26.9+ declare an unbounded hishel>=1, so the pdm e2e_vex_build job fails on every PR (it is the red check on #2022, #2017, #2016, #2014, #2011, #2008, #2003). This pins hishel<2 for PDM >= 2.26.1 in the e2e harness and the backtest script, alongside the existing hishel<1 / unearth<0.19 pins. Test-harness only; no product code changes.

Risk: low. Two pin additions in test tooling; no effect on the shipped CLI. For 2.26.1-2.26.8 the pin is a no-op (they already bound <1).

Look here

  • pdm.rs:139-147: the new else if t >= (2, 26, 1) branch
  • backtest-pdm.py:207-212: the same rule in the backtest script (elif binds to the hishel<1 if, so the ranges are disjoint)

Verified

  • Read the full diff (2 files, +14). Branch ranges in Rust and Python match and don't overlap.
  • python3 -m py_compile scripts/backtest-pdm.py passes.
  • CI on this head: 50/50 (31 success, 19 path-skipped); the pdm e2e_vex_build job ran and passed. Bugbot: no findings. CHANGELOG.md untouched.

Changes I made: none.

Open questions: none blocking. (Nit: required_pins in the backtest doesn't list hishel, so a cached backtest venv built after today wouldn't be detected as broken; same as the existing unearth pin, so out of scope.)

Merging this should turn the other Ready-for-review PRs green after they pick up main. Auto-merge is armed, so approving sends it straight to the merge queue.


Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

This was referenced Nov 6, 2026
Stop attesting sbt pins a build reassignment or uncommitted wiring bypasses #2030
Merged
Stop attesting npm-family pins pnpm or a user patch overrides #2010
Merged
Stop attesting NuGet versions the writers refuse #2007
Merged
Stop vendored Maven liveness attesting unpatched builds #2006
Merged
Stop vendored Gradle liveness attesting a version the lockfile overrides #2004
Merged
Plan one lock model for every lockfile reader #2001
Merged
Fix Maven VEX false attestation through profiles, properties and coordinates #2005
Merged
chore(release): 5.1.0 #2032
Merged
Tanmay182003
Tanmay Singla (Tanmay182003) approved these changes Nov 6, 2026
View reviewed changes
@mikolalysenko
Mikola Lysenko (mikolalysenko) added this pull request to the merge queue Nov 6, 2026
Tanmay182003
Tanmay Singla (Tanmay182003) approved these changes Nov 6, 2026
View reviewed changes
Merged via the queue into main with commit c6a4fda Nov 6, 2026
50 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@mikolalysenko
Mikola Lysenko (mikolalysenko) deleted the ci-janitor/pdm-hishel-2 branch November 6, 2026 20:47
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 6, 2026
@claude
Merge main into release/v5.1.0 to pick up the pdm e2e fix (#2028)
d9c57ae
The release PR's only red check was the pdm e2e that failed main-wide;
#2028 fixed it on main.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@mikolalysenko Mikola Lysenko (mikolalysenko) mentioned this pull request Nov 6, 2026
Let the pdm e2e bootstrap install pdm 2.29.4+ #2034
Merged
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 7, 2026
@claude
Merge main to pick up the pdm hishel pin (#2028)
31b15a9
The e2e_vex_build pdm leg failed on this head because it predated #2028.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 7, 2026
@claude
Merge main to pick up the pdm hishel pin (#2028)
734155c
The e2e_vex_build pdm leg failed on this head because it predated #2028.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 7, 2026
@claude
Merge main to pick up the pdm hishel pin (#2028)
0ec856e
The e2e_vex_build pdm leg failed on this head because it predated #2028.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 7, 2026
@claude
Merge main to pick up the pdm hishel pin (#2028)
8cd39db
The e2e_vex_build pdm leg failed on this head because it predated #2028.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 7, 2026
@claude
Merge main to pick up the pdm hishel pin (#2028)
34a8374
The e2e_vex_build pdm leg failed on this head because it predated #2028.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 7, 2026
@claude
Merge main to pick up the pdm hishel pin (#2028)
9949a3b
The e2e_vex_build pdm leg failed on this head because it predated #2028.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 7, 2026
@claude
Merge main to pick up the pdm hishel pin (#2028)
4e20ed6
The e2e_vex_build pdm leg failed on this head because it predated #2028.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Nov 7, 2026
@claude
Merge main to pick up the pdm hishel pin (#2028)
cc81455
The e2e_vex_build pdm leg failed on this head because it predated #2028.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@mikolalysenko Mikola Lysenko (mikolalysenko) mentioned this pull request Nov 7, 2026
chore(release): 5.1.0 notes for PRs merged during review #2033
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Tanmay182003 Tanmay Singla (Tanmay182003) Tanmay182003 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

ci-janitor Opened by the CI janitor routine (flakes, redundant tests, CI perf) Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@mikolalysenko @Tanmay182003 @claude
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.