Warn when there are missing bounds on transitive deps in lowest

crates/distribution-types/src/resolution.rs

@@ -92,6 +92,11 @@ pub enum ResolutionDiagnostic {
  /// The reason that the version was yanked, if any.
  reason: Option<String>,
  },
+ MissingLowerBound {
+ /// The name of the package that had no lower bound from any other package in the
+ /// resolution. For example, `black`.
+ package_name: PackageName,
+ },
 }
 
 impl Diagnostic for ResolutionDiagnostic {
@@ -111,6 +116,13 @@ impl Diagnostic for ResolutionDiagnostic {
  format!("`{dist}` is yanked")
  }
  }
+ Self::MissingLowerBound { package_name: name } => {
+ format!(
+ "The transitive dependency `{name}` is unpinned. \
+ Consider setting a lower bound with a constraint when using \
+ `--resolution-strategy lowest` to avoid using outdated versions."
+ )
+ }
  }
  }
 
@@ -120,6 +132,7 @@ impl Diagnostic for ResolutionDiagnostic {
  Self::MissingExtra { dist, .. } => name == dist.name(),
  Self::MissingDev { dist, .. } => name == dist.name(),
  Self::YankedVersion { dist, .. } => name == dist.name(),
+ Self::MissingLowerBound { package_name } => name == package_name,
  }
  }
 }

crates/pep440-rs/src/version_specifier.rs

@@ -624,6 +624,22 @@ impl VersionSpecifier {
 
  other > this
  }
+
+ /// Whether this version specifier rejects versions below a lower cutoff.
+ pub fn has_lower_bound(&self) -> bool {
+ match self.operator() {
+ Operator::Equal
+ | Operator::EqualStar
+ | Operator::ExactEqual
+ | Operator::TildeEqual
+ | Operator::GreaterThan
+ | Operator::GreaterThanEqual => true,
+ Operator::LessThanEqual
+ | Operator::LessThan
+ | Operator::NotEqualStar
+ | Operator::NotEqual => false,
+ }
+ }
 }
 
 impl FromStr for VersionSpecifier {

crates/pypi-types/src/requirement.rs

@@ -466,6 +466,17 @@ impl RequirementSource {
  pub fn is_editable(&self) -> bool {
  matches!(self, Self::Directory { editable: true, .. })
  }
+
+ /// If the source is the registry, return the version specifiers
+ pub fn version_specifiers(&self) -> Option<&VersionSpecifiers> {
+ match self {
+ RequirementSource::Registry { specifier, .. } => Some(specifier),
+ RequirementSource::Url { .. }
+ | RequirementSource::Git { .. }
+ | RequirementSource::Path { .. }
+ | RequirementSource::Directory { .. } => None,
+ }
+ }
 }
 
 impl Display for RequirementSource {

crates/uv-resolver/src/resolution/graph.rs

@@ -3,7 +3,7 @@ use std::collections::BTreeSet;
 use indexmap::IndexSet;
 use petgraph::{
  graph::{Graph, NodeIndex},
- Directed,
+ Directed, Direction,
 };
 use pubgrub::Range;
 use rustc_hash::{FxBuildHasher, FxHashMap, FxHashSet};
@@ -25,6 +25,7 @@ use crate::preferences::Preferences;
 use crate::python_requirement::PythonTarget;
 use crate::redirect::url_to_precise;
 use crate::resolution::AnnotatedDist;
+use crate::resolution_mode::ResolutionStrategy;
 use crate::resolver::{Resolution, ResolutionDependencyEdge, ResolutionPackage};
 use crate::{
  InMemoryIndex, MetadataResponse, Options, PythonRequirement, RequiresPython, ResolveError,
@@ -86,6 +87,7 @@ impl ResolutionGraph {
  index: &InMemoryIndex,
  git: &GitResolver,
  python: &PythonRequirement,
+ resolution_strategy: &ResolutionStrategy,
  options: Options,
  ) -> Result<Self, ResolveError> {
  let size_guess = resolutions[0].nodes.len();
@@ -194,6 +196,10 @@ impl ResolutionGraph {
  )
  };
 
+ if matches!(resolution_strategy, ResolutionStrategy::Lowest) {
+ report_missing_lower_bounds(&petgraph, &mut diagnostics);
+ }
+
  Ok(Self {
  petgraph,
  requires_python,
@@ -657,3 +663,72 @@ impl From<ResolutionGraph> for distribution_types::Resolution {
  )
  }
 }
+
+/// Find any packages that don't have any lower bound on them when in resolution-lowest mode.
+fn report_missing_lower_bounds(
+ petgraph: &Graph<ResolutionGraphNode, Option<MarkerTree>>,
+ diagnostics: &mut Vec<ResolutionDiagnostic>,
+) {
+ for node_index in petgraph.node_indices() {
+ let ResolutionGraphNode::Dist(dist) = petgraph.node_weight(node_index).unwrap() else {
+ // Ignore the root package.
+ continue;
+ };
+ if dist.dev.is_some() {
+ // TODO(konsti): Dev dependencies are modelled incorrectly in the graph. There should
+ // be an edge from root to project-with-dev, just like to project-with-extra, but
+ // currently there is only an edge from project to to project-with-dev that we then
+ // have to drop.
+ continue;
+ }
+ if !has_lower_bound(node_index, dist.name(), petgraph) {
+ diagnostics.push(ResolutionDiagnostic::MissingLowerBound {
+ package_name: dist.name().clone(),
+ });
+ }
+ }
+}
+
+/// Whether the given package has a lower version bound by another package.
+fn has_lower_bound(
+ node_index: NodeIndex,
+ package_name: &PackageName,
+ petgraph: &Graph<ResolutionGraphNode, Option<MarkerTree>>,
+) -> bool {
+ for neighbor_index in petgraph.neighbors_directed(node_index, Direction::Incoming) {
+ let neighbor_dist = match petgraph.node_weight(neighbor_index).unwrap() {
+ ResolutionGraphNode::Root => {
+ // We already handled direct dependencies with a missing constraint
+ // separately.
+ return true;
+ }
+ ResolutionGraphNode::Dist(neighbor_dist) => neighbor_dist,
+ };
+
+ if neighbor_dist.name() == package_name {
+ // Only warn for real packages, not for virtual packages such as dev nodes.
+ return true;
+ }
+
+ // Get all individual specifier for the current package and check if any has a lower
+ // bound.
+ for requirement in neighbor_dist
+ .metadata
+ .requires_dist
+ .iter()
+ .chain(neighbor_dist.metadata.dev_dependencies.values().flatten())
+ {
+ if requirement.name != *package_name {
+ continue;
+ }
+ let Some(specifiers) = requirement.source.version_specifiers() else {
+ // URL requirements are a bound.
+ return true;
+ };
+ if specifiers.iter().any(VersionSpecifier::has_lower_bound) {
+ return true;
+ }
+ }
+ }
+ false
+}

crates/uv-resolver/src/resolver/mod.rs

@@ -627,6 +627,7 @@ impl<InstalledPackages: InstalledPackagesProvider> ResolverState<InstalledPackag
  &self.index,
  &self.git,
  &self.python_requirement,
+ self.selector.resolution_strategy(),
  self.options,
  )
  }
@@ -2156,7 +2157,11 @@ impl ForkState {
  ResolutionStrategy::Lowest | ResolutionStrategy::LowestDirect(..)
  );
  if !has_url && missing_lower_bound && strategy_lowest {
- warn_user_once!("The direct dependency `{package}` is unpinned. Consider setting a lower bound when using `--resolution-strategy lowest` to avoid using outdated versions.");
+ warn_user_once!(
+ "The direct dependency `{package}` is unpinned. \
+ Consider setting a lower bound when using `--resolution-strategy lowest` \
+ to avoid using outdated versions."
+ );
  }
  }
 

crates/uv/tests/lock.rs

@@ -5839,3 +5839,35 @@ fn lock_upgrade_drop_fork_markers() -> Result<()> {
  assert!(!lock.contains("environment-markers"));
  Ok(())
 }
+
+/// Warn when there are missing bounds on transitive dependencies with `--resolution lowest`.
+#[test]
+fn warn_missing_transitive_lower_bounds() -> Result<()> {
+ let context = TestContext::new("3.12");
+
+ let pyproject_toml = context.temp_dir.child("pyproject.toml");
+ pyproject_toml.write_str(
+ r#"
+ [project]
+ name = "foo"
+ version = "0.1.0"
+ requires-python = ">=3.12"
+ dependencies = ["pytest>8"]
+ "#,
+ )?;
+
+ uv_snapshot!(context.filters(), context.lock().arg("--resolution").arg("lowest"), @r###"
+ success: true
+ exit_code: 0
+ ----- stdout -----
+
+ ----- stderr -----
+ warning: `uv lock` is experimental and may change without warning
+ Resolved 6 packages in [TIME]
+ warning: The transitive dependency `packaging` is unpinned. Consider setting a lower bound with a constraint when using `--resolution-strategy lowest` to avoid using outdated versions.
+ warning: The transitive dependency `colorama` is unpinned. Consider setting a lower bound with a constraint when using `--resolution-strategy lowest` to avoid using outdated versions.
+ warning: The transitive dependency `iniconfig` is unpinned. Consider setting a lower bound with a constraint when using `--resolution-strategy lowest` to avoid using outdated versions.
+ "###);
+
+ Ok(())
+}