fix(code): targeted uv constraints for dcode prerelease deps - #4744
Merged
Mason Daugherty (mdrxy) merged 4 commits intoJul 15, 2026
Conversation
Stable deepagents-code releases can mandate an exact prerelease hard dependency (e.g. deepagents==0.7.0a7). The updater handled this with a global `--prerelease allow`, which widened the candidate set for every package and let an unrelated optional provider float to an unbuildable prerelease (litellm RC on Python 3.14, #4524). perform_upgrade now extracts the mandatory, unconditional, exact prerelease pins from the target release metadata, writes them to a temporary uv constraints file, and runs with `--constraints <file> --prerelease if-necessary-or-explicit` — admitting only the named prerelease while unrelated optional deps stay stable. The explicit prerelease-channel path keeps `--prerelease allow` unchanged. The boolean cache is redesigned into a structured per-version pin cache. Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
github-actions
Bot
added
dcode
Mason Daugherty (mdrxy)
marked this pull request as ready for review
July 15, 2026 12:39
Mason Daugherty (mdrxy)
changed the title
![open-swe[bot]](https://avatars.githubusercontent.com/in/1395372?s=60&v=4){kind=small}
Mason Daugherty (mdrxy)
deleted the
open-swe/targeted-prerelease-constraints
branch
July 15, 2026 13:49
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Jul 16, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.40](deepagents-code==0.1.39...deepagents-code==0.1.40) (2026-07-16) ### Features - Added plugin marketplace support ([#4554](#4554)). - Added an “always allow” option to the project MCP approval prompt ([#4562](#4562)). - Improved `/goal` workflows: criteria generation now runs server-side, YOLO mode auto-accepts criteria, goals complete after satisfied grading, and goal review editing now supports `Ctrl+X` ([#4754](#4754), [#4784](#4784), [#4781](#4781), [#4780](#4780)). - Reasoning effort now persists across restarts ([#4728](#4728)). - Added a toast prompting you to re-paste when a chat paste collapses ([#4742](#4742)). ### Bug Fixes - Tool calls awaiting approval are now surfaced correctly ([#4739](#4739)). - Fixed transcript tail hydration when scrolled to the bottom edge ([#4733](#4733)). - Kept chat input responsive during MCP viewer `Ctrl+R` reconnects ([#4753](#4753)). - Improved inline free-text prompts by sharing paste handling and matching primary-input `Ctrl+D` behavior ([#4736](#4736), [#4729](#4729)). - Fixed local offloaded tool results to use the real filesystem ([#4740](#4740)). - Cleaned offloaded history when deleting a thread ([#4751](#4751)). - Removed duplicated content from the system prompt by overwriting the base prompt ([#4516](#4516)). - Closed subprocess transport during install teardown ([#4735](#4735)). - Added targeted `uv` constraints for prerelease dependencies ([#4744](#4744)). _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
…in-ai#4744) Closes langchain-ai#4524 `dcode` updates that require a prerelease SDK dependency no longer allow unrelated optional providers to install prerelease versions, avoiding failed upgrades from unbuildable release candidates. --- Stable `deepagents-code` releases can intentionally require an exact prerelease hard dependency (e.g. `deepagents==0.7.0a7`). The updater handled this by adding a global `--prerelease allow`, which widens the resolver's candidate set for *every* package — so an unrelated optional provider could float to an unbuildable prerelease. That is what caused langchain-ai#4524 (a `litellm` RC failing to build on Python 3.14). `perform_upgrade()` now identifies the mandatory, unconditional, exact prerelease pins from the target release's PyPI metadata, writes them to a temporary uv constraints file, and runs with `--constraints <file> --prerelease if-necessary-or-explicit`. uv then admits only the named prerelease (e.g. the SDK alpha) while unrelated optional dependencies stay on their stable releases. The exact dcode target pin, installed extras, receipt `--with` packages, interpreter selection, and transactional uv-tool behavior are all preserved. The explicit dcode prerelease-*channel* path (installed prerelease or `--prerelease`) is unchanged and still uses `--prerelease allow`. The marker-agnostic boolean cache (`release_requires_prereleases`) is redesigned into a structured, versioned per-version pin cache (`release_prerelease_pins`); the legacy boolean key is never read as authoritative. `release_requires_prereleases()` is kept as a backward-compatible boolean wrapper for the display-only callers in `app.py`/`main.py`. The requirement classifier is deliberately limited to unconditional exact pins — marker-bearing pins (extra-gated or interpreter/platform-gated) are ignored rather than evaluated against a possibly-wrong interpreter; this limit is documented in code and tests. Constraint-file lifecycle is a context manager: the file lives for the full subprocess invocation and is removed in `finally`, tolerating cleanup errors without masking the install result. A constraint-generation failure leaves the existing install untouched and returns actionable output rather than silently reverting to a global allow. Audit of other receipt-aware/global-allow paths (scoped follow-ups, not fixed here to avoid broad refactoring and offline-install regressions): - `install_extra` / `install_package` build commands unconditionally use `--prerelease allow`; they pin the current version, so converting them safely needs the same targeted-constraint plumbing plus offline-fallback handling. - `dependency_refresh` only adds `--prerelease allow` when following the prerelease channel, so it does not exhibit the metadata-driven global-allow bug for stable installs (it fails safe instead). - `scripts/install.sh` still defaults `DEEPAGENTS_CODE_PRERELEASE=allow` for fresh installs; porting the targeted strategy to bash is a larger installer change with its own tests. Made by [Open SWE](https://openswe.vercel.app/agents/90a3f170-5a1a-ed8b-3c37-d97d6021c97d) --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.40](langchain-ai/deepagents@deepagents-code==0.1.39...deepagents-code==0.1.40) (2026-07-16) ### Features - Added plugin marketplace support ([langchain-ai#4554](langchain-ai#4554)). - Added an “always allow” option to the project MCP approval prompt ([langchain-ai#4562](langchain-ai#4562)). - Improved `/goal` workflows: criteria generation now runs server-side, YOLO mode auto-accepts criteria, goals complete after satisfied grading, and goal review editing now supports `Ctrl+X` ([langchain-ai#4754](langchain-ai#4754), [langchain-ai#4784](langchain-ai#4784), [langchain-ai#4781](langchain-ai#4781), [langchain-ai#4780](langchain-ai#4780)). - Reasoning effort now persists across restarts ([langchain-ai#4728](langchain-ai#4728)). - Added a toast prompting you to re-paste when a chat paste collapses ([langchain-ai#4742](langchain-ai#4742)). ### Bug Fixes - Tool calls awaiting approval are now surfaced correctly ([langchain-ai#4739](langchain-ai#4739)). - Fixed transcript tail hydration when scrolled to the bottom edge ([langchain-ai#4733](langchain-ai#4733)). - Kept chat input responsive during MCP viewer `Ctrl+R` reconnects ([langchain-ai#4753](langchain-ai#4753)). - Improved inline free-text prompts by sharing paste handling and matching primary-input `Ctrl+D` behavior ([langchain-ai#4736](langchain-ai#4736), [langchain-ai#4729](langchain-ai#4729)). - Fixed local offloaded tool results to use the real filesystem ([langchain-ai#4740](langchain-ai#4740)). - Cleaned offloaded history when deleting a thread ([langchain-ai#4751](langchain-ai#4751)). - Removed duplicated content from the system prompt by overwriting the base prompt ([langchain-ai#4516](langchain-ai#4516)). - Closed subprocess transport during install teardown ([langchain-ai#4735](langchain-ai#4735)). - Added targeted `uv` constraints for prerelease dependencies ([langchain-ai#4744](langchain-ai#4744)). _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4524
dcodeupdates that require a prerelease SDK dependency no longer allow unrelated optional providers to install prerelease versions, avoiding failed upgrades from unbuildable release candidates.Stable
deepagents-codereleases can intentionally require an exact prerelease hard dependency (e.g.deepagents==0.7.0a7). The updater handled this by adding a global--prerelease allow, which widens the resolver's candidate set for every package — so an unrelated optional provider could float to an unbuildable prerelease. That is what caused #4524 (alitellmRC failing to build on Python 3.14).perform_upgrade()now identifies the mandatory, unconditional, exact prerelease pins from the target release's PyPI metadata, writes them to a temporary uv constraints file, and runs with--constraints <file> --prerelease if-necessary-or-explicit. uv then admits only the named prerelease (e.g. the SDK alpha) while unrelated optional dependencies stay on their stable releases. The exact dcode target pin, installed extras, receipt--withpackages, interpreter selection, and transactional uv-tool behavior are all preserved. The explicit dcode prerelease-channel path (installed prerelease or--prerelease) is unchanged and still uses--prerelease allow.The marker-agnostic boolean cache (
release_requires_prereleases) is redesigned into a structured, versioned per-version pin cache (release_prerelease_pins); the legacy boolean key is never read as authoritative.release_requires_prereleases()is kept as a backward-compatible boolean wrapper for the display-only callers inapp.py/main.py. The requirement classifier is deliberately limited to unconditional exact pins — marker-bearing pins (extra-gated or interpreter/platform-gated) are ignored rather than evaluated against a possibly-wrong interpreter; this limit is documented in code and tests.Constraint-file lifecycle is a context manager: the file lives for the full subprocess invocation and is removed in
finally, tolerating cleanup errors without masking the install result. A constraint-generation failure leaves the existing install untouched and returns actionable output rather than silently reverting to a global allow.Audit of other receipt-aware/global-allow paths (scoped follow-ups, not fixed here to avoid broad refactoring and offline-install regressions):
install_extra/install_packagebuild commands unconditionally use--prerelease allow; they pin the current version, so converting them safely needs the same targeted-constraint plumbing plus offline-fallback handling.dependency_refreshonly adds--prerelease allowwhen following the prerelease channel, so it does not exhibit the metadata-driven global-allow bug for stable installs (it fails safe instead).scripts/install.shstill defaultsDEEPAGENTS_CODE_PRERELEASE=allowfor fresh installs; porting the targeted strategy to bash is a larger installer change with its own tests.Made by Open SWE