Post #1834522
2026-03-27 10:44 UTC
@almar @brettcannon "using a lockfile only for CI" We do this for napari! But we use requirements.txt based constraints, not pylock.toml, so when a version is updated, we kinda just bump it. 😅 (Once a week.) It does mean in most cases we have a built-in cooldown period.
But yes, this doesn't really help end users. I think the best thing for users is that uv/pip etc should have cooldown periods by default, and a --unsafe-get-absolute-latest opt-in flag for getting "today's" release.
Replies (1)
-
@brettcannon@mastodon.social 2026-03-28 02:34
@jni @almar it's more of a "catch on" for the community than expecting libraries to use lock files. What would have been also useful is a cooldown period before a new release is used in resolving dependencies.