Repository navigation
build(bundles): recompile saved bundle locks for the aiohttp 3.14.4 root lock - #855
Conversation
…oot lock The aiohttp 3.14.4 bump in #824 rewrote the root uv.lock without recompiling the saved bundle closures, so every target's manifest still bound the previous root lock hash and the verifier rejected all 16 targets with "bundle lock inputs changed; recompile and review the complete closure". Recompile all 16 targets with the existing 2026-10-18T00:00:00Z cutoff, which already admits aiohttp 3.14.4 and yarl 1.25.1. Ten closures that contain aiohttp move aiohttp 3.14.3 -> 3.14.4 and yarl 1.23.0 -> 1.25.1, matching the root pins; no other distribution, artifact or exception changes. The other six closures are byte-identical and only rebind the root lock hash.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Package lock records packages/sie_server/bundle-locks/cpu-default-*/pylock.toml, packages/sie_server/bundle-locks/cpu-sglang-*/pylock.toml, packages/sie_server/bundle-locks/cuda12-*/pylock.toml, packages/sie_server/bundle-locks/cuda13-*/pylock.toml |
The lock entries update aiohttp to 3.14.4 and yarl to 1.25.1. Source and wheel artifact records are refreshed, including URLs, sizes, timestamps, and hashes. |
Bundle manifest hashes packages/sie_server/bundle-locks/*/manifest.json |
The affected manifests record updated uv_lock_sha256 values. Some manifests also record updated overall lock_sha256 values. |
Possibly related PRs
- superlinked/sie#845: Added a saved bundle lock that this PR refreshes against the updated root lock.
Suggested reviewers: svonava
Priority:
Severity of issue fixed: Medium
Merge Risk: 
68aa4
-
The refreshed bundle locks and manifest bindings are internally consistent, with no identified merge-blocking risk.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly describes the main change: recompiling the saved bundle locks after the root lock update for aiohttp 3.14.4. It is concise and specific. Linked Issues check Issue #854requires recompilation and review of the saved bundle closures against the current root lock. The PR updates all 16 manifests to the currentuv.lock; it updates the ten affected closures …Out of Scope Changes check The changed files are limited to saved bundle manifests and pylock.tomlfiles underpackages/sie_server/bundle-locks/. The reported changes update the stale root-lock binding and the two distribut…Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Full details: Linked Issues check
-
Explanation
Issue
#854requires recompilation and review of the saved bundle closures against the current root lock. The PR updates all 16 manifests to the currentuv.lock; it updates the ten affected closures foraiohttp3.14.4 andyarl1.25.1, and refreshes only the input and derived lock hashes for the other six closures. The existingCI / Bundle resolutionjob runspython tools/ci/bundle_lock.py checkand is included inCI / Required, which satisfies the issue's alternative recurrence-prevention requirement. The reported validation also covers all 16 targets.
Full details: Out of Scope Changes check
-
Explanation
The changed files are limited to saved bundle manifests and
pylock.tomlfiles underpackages/sie_server/bundle-locks/. The reported changes update the stale root-lock binding and the two distributions affected by that root-lock change. No unrelated source, workflow, or dependency changes are present.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (26 skipped: 26 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Closes #854
Symptom
Since #824 (51af6a4), the saved-lock verifier rejects all 16 bundle targets with
ValueError: bundle lock inputs changed; recompile and review the complete closure.CI / Requiredfails onmainand on every pull request (details in #854).Cause
Each
packages/sie_server/bundle-locks/<target>/manifest.jsonbinds the SHA256 of the rootuv.lock. #824 rewrote the root lock: aiohttp 3.14.3 -> 3.14.4 and yarl 1.23.0 -> 1.25.1. The saved closures were not recompiled. For all 16 targets the only stale binding input wasinputs.uv_lock_sha256(536b7f46…->75848a1d…). Requirements, exceptions, source pins, the policy hash and the uv version were unchanged.Cutoff
This keeps the existing
--exclude-newer 2026-10-18T00:00:00Z, the cutoff recorded in all 16 current manifests (#802, #845). It already admits the new root versions. The last aiohttp 3.14.4 artifact was uploaded on 2026-10-05T17:43:48Z and the last yarl 1.25.1 artifact on 2026-09-15T19:35:02Z. A later cutoff would only admit newer releases of packages outside the root lock, which this fix does not need. With the same cutoff,exclude_newerstays unchanged in every manifest. Every other distribution resolves to the same version and artifacts as before.Changes per target
Recompiled with
tools/ci/bundle_lock.py compileand uv 0.9.28.exceptions.jsonis unchanged because no new root/bundle conflict appeared.cpu-default-{amd64,arm64},cpu-sglang-{amd64,arm64},cuda12-default-amd64,cuda12-sglang-amd64,cuda12-sglang-embedding-amd64,cuda12-sglang-vision-extract-amd64,cuda13-sglang-cu130-amd64,cuda13-tensorrt-llm-amd64(10)py3-none-anywheel, now listed. No other line changes.uv_lock_sha256,lock_sha256cpu-ctranslate2-{amd64,arm64},cpu-transformers5-{amd64,arm64},cuda12-ctranslate2-amd64,cuda12-transformers5-amd64(6)uv_lock_sha256Package counts per target are unchanged. aiohttp 3.14.4 and yarl 1.25.1 add no dependencies. An audit of the raw diff found that every changed
pylock.tomlline belongs to aiohttp or yarl. The only changed manifest keys areinputs.uv_lock_sha256(16) andlock_sha256(10).Validation
From a fresh clone bootstrapped with
./tools/init.sh:Follow-up (not in this PR)
The
pull_request.pathsfilters of.github/workflows/cuda13-sglang-cu130.ymland.github/workflows/cuda13-tensorrt-llm.ymlinclude neitheruv.locknorpackages/sie_server/bundle-locks/**. A root-lock bump or a saved-lock recompile like this one therefore does not trigger the CUDA 13 image compatibility checks, even though both inputs determine those images. A follow-up should add both paths. This PR leaves the workflows unchanged because the documented lock-update procedure does not require a workflow change.Summary by CodeRabbit