uv sync is made with --locked, not --frozen

[vperron]

python-buildpack/lib/uv.sh

Line 144 in 8cd6378

--locked

It seems the intent behind this is misinformed: --locked will fail if we don't have the latest up-to-date versions in the lockfile, in regard of the versions provided in the pyproject.toml.

This can make entirely legit builds, with a proper lockfile, fail because the pyproject.toml is updated to latest versions and the lockfile is not.

I guess we want to use --frozen here and not --locked. Right ?

[Frzk]

Hello @vperron

Thanks for bringing this up.

We feel like --locked remains the best option since it ensures your pyproject.toml and lockfile are "synchronized". This sounds the safest option to us.

Could you please tell us more about your usecase and how it's blocking?