lock upgrades some locked dependencies with no --upgrade flag

Summary

UV updates some packages when locking with no upgrade flag:

Take a pyproject.toml file with two packages.
Here, requests and an example package:

[project]
name = "lock-test"
version = "0.1.0"
description = "Add your description here"
readme = "README.md"
requires-python = ">=3.13"
dependencies = [ "requests<=2.29", "example-package<=2.29"]

run uv lock → both are locked to the matching version 2.29.0
change the pyproject toml to allow higher version (or upload a new package version):

[project]
name = "lock-test"
version = "0.1.0"
description = "Add your description here"
readme = "README.md"
requires-python = ">=3.13"
dependencies = [ "requests>=2.29", "example-package>=2.29"]

run uv lock

expected behavior:

lockfile is updated but no dependencies change

observed behavior:
requests stays with the locked version, but example-package is updated to the latest version.

I have done some investigation and it seems to be related to the uploaded distributions. example-package only contains py3-none-any wheel files: GET $INDEX/simple/example-package ->
example-package-2.29.0-py3-none-any.whl, example-package-2.29.1-py3-none-any.whl

This error occurs on any package where this is the case and does not appear as soon as sdist or an additional wheel platform was uploaded.

Platform

macOS26

Version

0.9.4

Python version

3.10-3.13

[charliermarsh]

Can you please create an example that we can run against PyPI?

I found a package that only contains the py3-none-any wheels but to my surprise, it does not cause the same issue. So this may be caused by artifactory. I'll do some more debugging to see if I can reproduce it more reliably

I think I now found the actual condition for reproducing it. It only occurs when authentication is used.
I reproduced it on both artifactory and gitlab package registries. If I take an open index and set authenticate = "always", the package is updated. When I change that to authenticate = "never" it is not.

I used the package 12factor-vault here because that meets the "only py3-none-any.whl" condition on pypi.org. I'd expect this to happen with any package thats deployed with uv build --wheel and twine upload dist/*