uv lock to use overrides from tool.uv (#4108)

[idlsoft]

Summary

This will make uv lock read override-dependencies from the [tool.uv] section of pyproject.toml.
Resolves #4108

This other implementation touches more code but seems more consistent.

Test Plan

Unit test

[BurntSushi]

I think this LGTM, but I think @konstin should sign off on this before merging.

[BurntSushi]

I think this can be removed?

[idlsoft]

I think this can be removed?

Wanted to make it explicit that it's now immutable

[BurntSushi]

We don't usually do this in our code. It would add a lot of noise.

[konstin]

fyi i removed it and also changed the iteration style to align more with what we do elsewhere

[konstin]

Currently, this can have effects on neighbouring packages: Say you have a non-project workspace root and in it two package foo, bar and baz.

foo has:

tool.uv.override-dependencies = [
   "anyio==4.3.0"
]

bar has:

dependencies = [
    "anyio==4.4.0"
]

baz has:

tool.uv.override-dependencies = [
   "lib_that_uses_anyio=1.2.3"
]

This means foo changes the resolution of both bar and baz, once directly and once indirectly. Since overrides apply globally, i think we should only allow them in the workspace root.

[idlsoft]

This means foo changes the resolution of both bar and baz, once directly and once indirectly. Since overrides apply globally, i think we should only allow them in the workspace root.

I assume you mean foo, bar and baz don't depend on each other.
You're right, but it's also not entirely new. The fact that one virtualenv is shared by all workspace members is bound to have side-effects.

As convinient as a shared virtualenv is, I kinda wish there was a way to require a private one per member.
As it stands right now dependency versions are negotiated by unrelated workspace members.
Also you can have a line in bar that references lib_that_uses_anyio or foo, and it'll work fine in the virtualenv, but not when bar is shipped as a standalone library.

On an unrelated note, if someone could also take a look at astral-sh/rye#1015 I'd appreciate it. I'm a bit stuck with one of my projects.

[idlsoft]

I've tried a different implementation, I think it's more in line with existing code.

[idlsoft]

Updated, it now gets overrides from the workspace only.

[charliermarsh]

I think this looks correct.