Repository navigation
fix(build): pin locked dependency versions in installers - #185
Merged
Merged
Conversation
The install scripts used `uv tool install` without a lockfile, so they re-resolved dependencies to the newest versions allowed by pyproject. That drifts from the tested set: once litellm 1.92+ shipped a Rust extension with Linux-only wheels, Windows/macOS installs broke because the source build needs a compiler (link.exe / a Rust toolchain). Export the locked constraints at release time (`uv export --locked`, attached as raven-constraints.txt) and pass them to `uv tool install -c` in install.sh, install.ps1, and the `raven upgrade` self-upgrade helper. The constraints URL is derived from the wheel URL so it always matches the wheel being installed, including the RAVEN_WHEEL_URL escape hatch. A missing asset or a failed download degrades to an unconstrained install rather than aborting. Nothing in pyproject changes: uv lock still governs when litellm upgrades; the pin only applies to distribution. Co-authored-by: Claude (claude-opus-4-8) <noreply@anthropic.com>
Co-authored-by: Claude (claude-opus-4-8) <noreply@anthropic.com>
0xKT
requested review from
TongLi31,
alwaysday1,
arelchan,
chuanruihu and
cyfyifanchen
and removed request for
TongLi31,
chuanruihu and
cyfyifanchen
July 22, 2026 14:05
alwaysday1
approved these changes
Jul 22, 2026
chuanruihu
approved these changes
Jul 22, 2026
0xKT
added a commit
that referenced
this pull request
Jul 22, 2026
## Summary Bump version from 0.1.7 to 0.1.8. Release commit only touches `pyproject.toml` and `uv.lock` (kept in sync via `uv lock`). Changes bundled into this release since v0.1.7: - feat(importer): cold-start import from other AI tools with EverOS HTTP backend (#170) - fix(build): pin locked dependency versions in installers (#185) - fix(cli): stop blank api key exiting deep_research prompt (#184) - fix: use redirect-free install.ps1 url on windows powershell 5.1 (#182) - fix(tui): brighten selection highlight for readability (#175) - fix(commitlint): align subject-case with conventional-commits standard (#187) ## Type - [x] Other ## Verification - [x] Relevant lint / type checks pass locally ``` python3 scripts/check_commit_messages.py origin/main..HEAD # exit 0 git diff --stat # pyproject.toml + uv.lock, 1 line each ``` ## Risk - [x] Backward compatibility considered Version bump only; no source changes. ## Related Issues N/A Co-authored-by: Claude (claude-opus-4-8) <noreply@anthropic.com>
KevinHuSh
pushed a commit
to KevinHuSh/Raven
that referenced
this pull request
Sep 14, 2026
…#185) ## Change description The one-click installers ran `uv tool install` without a lockfile, so they re-resolved dependencies to the newest versions allowed by `pyproject.toml` instead of the tested set. Once `litellm` 1.92+ shipped a Rust extension with Linux-only wheels, Windows/macOS installs broke: with no wheel, the sdist builds from source and needs a compiler (`link.exe` / a Rust toolchain). Fix, without touching the `pyproject.toml` constraints (so `uv lock` still governs when litellm upgrades): - **release.yml**: export the locked dependency set as a `raven-constraints.txt` release asset via `uv export --locked --all-extras --no-hashes`. `--locked` fails the release if `uv.lock` is stale vs `pyproject.toml`, so we never ship constraints that conflict with the wheel's own metadata. - **install.sh / install.ps1**: pass the constraints to `uv tool install -c`. The constraints URL is derived from the wheel URL (same release directory) so it always matches the wheel being installed, including the `RAVEN_WHEEL_URL` escape hatch. A missing asset or a failed download degrades to an unconstrained install rather than aborting. - **raven upgrade** (`upgrade_commands.py`): the self-upgrade helper does the same derive-and-pin, so upgrading an installed copy no longer re-triggers the litellm source build either. With the pin, litellm resolves to the locked 1.85.0 (pure-Python, wheels on all platforms), so no compiler is needed anywhere. **Rollout note:** this only takes effect once a new release is cut (so the `raven-constraints.txt` asset exists). Existing releases have no such asset and the scripts degrade to the current unconstrained behavior. Recommend cutting an rc first and verifying a zero-compile install on real Windows and macOS before the stable tag. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Document - [ ] Others ## Related issues Closes EverMind-AI#181 ## Checklists ### Development - [x] Lint rules pass locally - [ ] Application changes have been tested thoroughly - [x] Automated tests covering modified code pass > Unit tests and the full CI preflight pass locally (upgrade-helper tests cover > both the pinned and the graceful-fallback paths). End-to-end Windows/macOS > installs were not run on real machines; that should happen on an rc tag before > the stable release. ### Security - [x] Security impact of change has been considered - [x] Code follows security best practices and guidelines > The constraints URL is derived from the wheel URL, which `_parse_release_payload` > already validates as a trusted github.com release path; constraints only pin > versions, they do not execute code. ### Code review - [x] Pull request has a descriptive title and context useful to a reviewer --------- Co-authored-by: Claude (claude-opus-4-8) <noreply@anthropic.com>
KevinHuSh
pushed a commit
to KevinHuSh/Raven
that referenced
this pull request
Sep 14, 2026
## Summary Bump version from 0.1.7 to 0.1.8. Release commit only touches `pyproject.toml` and `uv.lock` (kept in sync via `uv lock`). Changes bundled into this release since v0.1.7: - feat(importer): cold-start import from other AI tools with EverOS HTTP backend (EverMind-AI#170) - fix(build): pin locked dependency versions in installers (EverMind-AI#185) - fix(cli): stop blank api key exiting deep_research prompt (EverMind-AI#184) - fix: use redirect-free install.ps1 url on windows powershell 5.1 (EverMind-AI#182) - fix(tui): brighten selection highlight for readability (EverMind-AI#175) - fix(commitlint): align subject-case with conventional-commits standard (EverMind-AI#187) ## Type - [x] Other ## Verification - [x] Relevant lint / type checks pass locally ``` python3 scripts/check_commit_messages.py origin/main..HEAD # exit 0 git diff --stat # pyproject.toml + uv.lock, 1 line each ``` ## Risk - [x] Backward compatibility considered Version bump only; no source changes. ## Related Issues N/A Co-authored-by: Claude (claude-opus-4-8) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change description
The one-click installers ran
uv tool installwithout a lockfile, so theyre-resolved dependencies to the newest versions allowed by
pyproject.tomlinstead of the tested set. Once
litellm1.92+ shipped a Rust extension withLinux-only wheels, Windows/macOS installs broke: with no wheel, the sdist builds
from source and needs a compiler (
link.exe/ a Rust toolchain).Fix, without touching the
pyproject.tomlconstraints (souv lockstillgoverns when litellm upgrades):
raven-constraints.txtrelease asset via
uv export --locked --all-extras --no-hashes.--lockedfails the release if
uv.lockis stale vspyproject.toml, so we never shipconstraints that conflict with the wheel's own metadata.
uv tool install -c.The constraints URL is derived from the wheel URL (same release directory) so
it always matches the wheel being installed, including the
RAVEN_WHEEL_URLescape hatch. A missing asset or a failed download degrades to an
unconstrained install rather than aborting.
upgrade_commands.py): the self-upgrade helper does thesame derive-and-pin, so upgrading an installed copy no longer re-triggers the
litellm source build either.
With the pin, litellm resolves to the locked 1.85.0 (pure-Python, wheels on all
platforms), so no compiler is needed anywhere.
Rollout note: this only takes effect once a new release is cut (so the
raven-constraints.txtasset exists). Existing releases have no such asset andthe scripts degrade to the current unconstrained behavior. Recommend cutting an
rc first and verifying a zero-compile install on real Windows and macOS before
the stable tag.
Type of change
Related issues
Closes #181
Checklists
Development
Security
Code review