From 9c7332190cf7291329c770bedb2ba1b3e441b37c Mon Sep 17 00:00:00 2001
From: soujasK <121026960+soujasK@users.noreply.github.com>
Date: Mon, 26 Oct 2026 13:07:03 +0530
Subject: [PATCH] fix: allow whitespace in uv requirement specifiers (#1112)

## Summary

When the uv version is read from dependencies (`requirements.txt`, or
`project.dependencies` / `optional-dependencies` / `dependency-groups`
in `pyproject.toml` via `version-file`), the specifier was matched with
`/^uv([=<>~!]+\S*)/`. PEP 508 allows whitespace around operators and
after commas, and those valid forms were misread:

| dependency | before | after |
|---|---|---|
| `uv >= 0.5.0` | not found, latest uv installed | `>=0.5.0` |
| `uv == 0.11.20` | not found, latest uv installed | `==0.11.20` |
| `uv>=0.5.0, <0.6.0` | `>=0.5.0,`, fails with `No version found for
>=0.5.0,` | `>=0.5.0,<0.6.0` |

The regex now allows whitespace around operators and between
comma-separated clauses, and strips it from the result. Inputs that
worked before give the same result, including inline `--hash=` options,
trailing ` # comments`, the `\` continuation lines from `uv pip compile
--generate-hashes`, and names that only start with `uv` (`uvicorn`,
`uv-build`).

## Test plan

- Added cases for spaced operators, spaced clauses, inline `--hash` and
trailing comments. The four whitespace cases failed before the change.
- `npm run all` on Ubuntu (WSL) with Node 24.19.0: build, Biome (no
fixes), packaging, and 165 tests across 15 suites pass. The rebuilt
`dist/setup/index.cjs` only differs in the changed line.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/version/requirements-file.test.ts | 11 +++++++++++
 dist/setup/index.cjs                        |  2 +-
 src/version/requirements-file.ts            |  4 +++-
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/__tests__/version/requirements-file.test.ts b/__tests__/version/requirements-file.test.ts
index 5ff0277..11f9ebf 100644
--- a/__tests__/version/requirements-file.test.ts
+++ b/__tests__/version/requirements-file.test.ts
@@ -35,3 +35,14 @@ test("strips PEP 508 markers from requirements dependencies", () => {
 
   expect(parsedVersion).toBe("==0.11.20");
 });
+
+test.each([
+  ["uv >= 0.5.0", ">=0.5.0"],
+  ["uv == 0.11.20", "==0.11.20"],
+  ["uv>=0.5.0, <0.6.0", ">=0.5.0,<0.6.0"],
+  ["uv >= 0.5.0 , < 0.6.0", ">=0.5.0,<0.6.0"],
+  ["uv==0.11.20 --hash=sha256:abc", "==0.11.20"],
+  ["uv==0.11.20  # pinned for CI", "==0.11.20"],
+])("allows whitespace in the uv specifier %s", (dependency, expected) => {
+  expect(getUvVersionFromRequirementsText(dependency)).toBe(expected);
+});
diff --git a/dist/setup/index.cjs b/dist/setup/index.cjs
index 0b7cf0c..0390261 100644
--- a/dist/setup/index.cjs
+++ b/dist/setup/index.cjs
@@ -101579,7 +101579,7 @@ function getUvVersionFromAllDependencies(allDependencies) {
 }
 function getUvVersionFromDependency(dependency) {
   const dependencyWithoutMarker = dependency.split(";", 1)[0]?.trim();
-  return dependencyWithoutMarker?.match(/^uv([=<>~!]+\S*)/)?.[1].trim();
+  return dependencyWithoutMarker?.match(/^uv\s*((?:[=<>~!]+\s*[^\s,]+\s*,?\s*)+)/)?.[1].replace(/\s/g, "");
 }
 
 // src/version/tool-versions-file.ts
diff --git a/src/version/requirements-file.ts b/src/version/requirements-file.ts
index 401a2c1..e335c5f 100644
--- a/src/version/requirements-file.ts
+++ b/src/version/requirements-file.ts
@@ -69,5 +69,7 @@ function getUvVersionFromAllDependencies(
 
 function getUvVersionFromDependency(dependency: string): string | undefined {
   const dependencyWithoutMarker = dependency.split(";", 1)[0]?.trim();
-  return dependencyWithoutMarker?.match(/^uv([=<>~!]+\S*)/)?.[1].trim();
+  return dependencyWithoutMarker
+    ?.match(/^uv\s*((?:[=<>~!]+\s*[^\s,]+\s*,?\s*)+)/)?.[1]
+    .replace(/\s/g, "");
 }