GeezerVison is showing github.com — Support hosted and vendored Hatch patches by mikolalysenko · Pull Request #244 · SocketDev/socket-patch
Conversation
LLM Description written by Codex:gpt-6-astra
Hatch projects lacked hosted and vendored manifest wiring. Add exact PEP 508 rewrites for project, optional and environment dependencies in pyproject.toml and hatch.toml, preserving extras, markers, external configuration precedence, comments and line endings. Vendored references use relocatable root URIs; both modes pin the artifact SHA-256.
Validate recorded artifact paths, pins and wheel bytes before repeated scans, refuse concurrent edits and symlinked inputs, and preserve shared ownership of Hatchling’s direct-reference permission during selective or preserved rollback. Existing requirements and lockfile routing keeps precedence. Python hosted confirmation now requires a successful writer, preventing an inactive Hatch URL from masking a refused UV/Poetry lock or failed metadata preparation. Environment discovery uses regular-file reads so FIFO configuration cannot hang a scan.
Vendored environments require Hatch >=1.2 and pip: earlier Hatch releases do not expand the root URI, and uv ignores local-wheel hash fragments. Vendored groups, ranges, transitive-only targets, dynamic metadata, source/plugin configurations and conditional overrides are refused before writes; the install hook remains available. Hosted environments support pip and uv.
Validation:
- 17 Hatch-focused Rust tests, 58 Poetry tests, 10 UV-lock tests and 72 requirements tests pass; CLI build and Clippy with warnings denied pass.
- Real CLI probes verify that rejected UV/legacy Poetry locks with inactive Hatch URLs report zero redirects, while a supported Poetry lock redirects and rolls back exactly.
- Native Windows/Linux matrix covers 13 releases across both Hatch majors, including installed patch-file hashes, wrong-digest rejection, repeated scans and rollback. The permanent compatibility report separates successful installs from safe refusals and upstream limitations.
- Companion depscan #26388 implements the SBOM support; its stacked tests and fixtures PR #26400 validates 1,267 captured/adversarial SBOM fixtures and preserves native manifest hashes and installer results.
Note Medium Risk
Changes PyPI redirect, vendor wire/revert, and hosted attestation logic; mistakes could mis-report patched deps, but behavior is fail-closed with explicit confirmed/refused UUID sets and broad tests.
Overview
Adds Hatch as a first-class PyPI path for hosted redirects and vendored wheels, rewriting exact == PEP 508 pins in pyproject.toml / hatch.toml (project, optional, and environment deps) to direct @ URLs with SHA-256 fragments and enabling allow-direct-references when needed. Vendored wiring uses {root:uri} pins, ledger-backed wire/revert, symlink and concurrent-edit refusal, and shared permission rollback; unsupported shapes (ranges, dynamic deps, uv-only envs for vendored hashes, etc.) fail closed toward the install hook.
Hosted scan confirmation stops inferring PyPI patches from URL substrings: redirects count only when the matching writer succeeds—python lock (uv/poetry/…), Hatch, or requirements—so an inactive Hatch URL cannot attest a failed or skipped lock rewrite. Scan inputs now include hatch.toml, pdm.lock, and Pipfile.lock.
Poetry virtualenv discovery reads config via read_regular_to_string so FIFO pyproject.toml / poetry.toml cannot hang scans; redirect replay adds Hatch document restore (including CRLF drift).
Reviewed by Cursor Bugbot for commit 31e74e4. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Wire exact Hatch requirements to hash-pinned wheels and guard repeat
scans and rollback against configuration or artifact drift.
Assisted-by: Codex:gpt-6-astra
Require Hatch 1.2 or later for vendored environment dependencies,
whose root placeholders older releases cannot expand. Exercise
rollback after newline conversion and refuse symlinked manifests.
Assisted-by: Codex:gpt-6-astra
Restore direct-reference settings after the last project source is
unwired, including selective and preserved rollback. Refuse malformed
metadata and local uv wheels whose digest fragments are ignored.
Confirm requirements-driven projects from active declarations.
Assisted-by: Codex:gpt-6-astra
Refuse vendored local wheels when uv is enabled through uv-path as
well as installer or environment configuration.
Assisted-by: Codex:gpt-6-astra
Distinguish the environment version floor from hosted support and
clarify shared permission ownership during rollback.
Assisted-by: Codex:gpt-6-astra
Keep Hatch and Poetry rollback handlers after the base update. Confirm
Python redirects only through successful writers, so inactive Hatch
sources cannot mask rejected locks. Read config files without blocking
on FIFOs during environment discovery.
Assisted-by: Codex:gpt-6-astra
Uh oh!
There was an error while loading. Please reload this page.
Mikola Lysenko (mikolalysenko)
added a commit
that referenced
this pull request
Sep 18, 2026
Conflicts resolved: the crawler runs Poetry's then Pipenv's out-of-tree
venv discovery (both gated on nothing found above); replay keeps the
PipenvEntry inverse next to main's HatchDocument; the hosted confirmed-uuid
filter confirms Pipfile.lock rewrites through `confirmed_pipenv_uuids`
alongside main's python-lock / hatch / requirements sets and still vetoes
`refused_pipenv_uuids`; main's generic Python stale-install guard
(`redirect_pypi_stale_install`, `known_stale`) replaces the Pipenv-specific
hosted probe — it now judges only the project's own venvs (no global
interpreter fallback) and names the Pipenv-specific remedy (`pipenv run pip
uninstall -y <pkg> && pipenv sync`, never `pipenv uninstall`) for
Pipfile.lock redirects; the pypi fetcher keeps the digest-set resolver
(superset of main's single-hash one); the candidate-file list, the
ecosystem matrix row, the hosted-e2e note, CHANGELOG and CLI_CONTRACT carry
both sides once.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
This was referenced Sep 18, 2026
This was referenced Sep 30, 2026
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|