chore(deps)(deps-dev): update maturin requirement from <1.15,>=1.10 to >=1.10,<1.16 in the all-dependencies group

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "diffctx",
   "displayName": "diffctx",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Smart git diff context for LLMs and AI agents: budgeted fragment selection, deterministic, MCP server included",
   "author": {
     "name": "Nikolay Eremeev",

.github/dependabot.yml

@@ -1,7 +1,42 @@
 version: 2
 updates:
+  # uv.lock only. `versioning-strategy: lockfile-only` keeps this entry off
+  # pyproject.toml's ranges, which the pip entry below owns — without the split
+  # both ecosystems see the same pyproject and open the same PR twice.
+  - package-ecosystem: "uv"
+    directory: "/"
+    versioning-strategy: "lockfile-only"
+    schedule:
+      interval: "weekly"
+      day: "saturday"
+      time: "10:00"
+      timezone: "Europe/Berlin"
+    cooldown:
+      default-days: 3
+    labels:
+      - "dependencies"
+    assignees:
+      - "nikolay-e"
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+
   - package-ecosystem: "pip"
     directory: "/"
+    # Raise a floor only when the declared range genuinely cannot admit the new
+    # version. The default (`increase`) rewrites the floor to the newest
+    # resolvable version on every run, and when that version already IS the
+    # floor the rewrite is a no-op that dependabot-core raises
+    # `Expected content to change!` on — numpy and scipy in
+    # requirements-eval.txt hit exactly that (their newest release supporting
+    # this project's `requires-python = ">=3.10"` floor is the version already
+    # written there), failing every weekly pip run since 2026-08-15. Security
+    # updates still get through: a fix that the range excludes IS necessary.
+    versioning-strategy: "increase-if-necessary"
     schedule:
       interval: "weekly"
       day: "saturday"
@@ -16,6 +51,16 @@ updates:
     commit-message:
       prefix: "chore(deps)"
       include: "scope"
+    ignore:
+      # mcp 2.x is a breaking SDK rewrite; the <2.0 pin in pyproject.toml is a
+      # deliberate compatibility decision (see the comment there). PR #219
+      # widened the bound mechanically and every test matrix failed at import.
+      # `versions` in addition to `update-types`: a "update requirement" range
+      # widening is not classified as semver-major (PR #224 got through), the
+      # explicit range is what actually blocks it.
+      - dependency-name: "mcp"
+        update-types: ["version-update:semver-major"]
+        versions: [">=2.0.0"]
     groups:
       all-dependencies:
         patterns:

.github/workflows/cd.yml

@@ -359,7 +359,7 @@ jobs:
           git checkout "$TAG_NAME"
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c  # stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # stable
         with:
           toolchain: '1.92.0'
 
@@ -712,12 +712,12 @@ jobs:
       # binaries in particular have no package index vouching for them the way
       # the wheels have PyPI's attestations (#147).
       - name: Attest build provenance for release assets
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
         with:
           subject-path: ./release-assets/*
 
       - name: Create GitHub Release with wheel and sdist assets
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           tag_name: ${{ needs.prepare-version.outputs.tag_name }}
           name: Release ${{ needs.prepare-version.outputs.version }}
@@ -825,7 +825,7 @@ jobs:
           ref: ${{ needs.prepare-version.outputs.tag_name }}
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
 
       - name: Login to ghcr
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
@@ -875,7 +875,7 @@ jobs:
           merge-multiple: true
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
 
       - name: Login to ghcr
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0

.github/workflows/ci.yml

@@ -24,10 +24,22 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
           python-version: '3.12'
+          enable-cache: true
+
+      # This job runs the cargo fmt and clippy hooks, so it is the one place
+      # that needs those components; rust-toolchain.toml deliberately does not
+      # pin them (see the comment there). It also compiles the extension, so
+      # cargo has to be on PATH at the pinned version rather than whatever the
+      # runner image happens to ship.
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: "1.92.0"
+          components: rustfmt, clippy
 
       - name: Cache pre-commit
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
@@ -37,9 +49,8 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install pre-commit
-          pip install -e ".[dev]"
+          uv sync --locked --no-build --extra dev
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
 
       - name: Run pre-commit
         run: pre-commit run --all-files
@@ -58,7 +69,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.92.0"
 
@@ -83,7 +94,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.92.0"
 
@@ -160,17 +171,23 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Set up Python 3.10
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
           python-version: '3.10'
-          cache: 'pip'
-          cache-dependency-path: 'pyproject.toml'
+          enable-cache: true
+
+      # Same reason as the pre-commit job: installing this package compiles the
+      # native extension, so cargo has to be on PATH at the pinned version.
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: "1.92.0"
 
       - name: Install Linters and Type Checker
         run: |
-          python -m pip install --upgrade pip
-          pip install .[dev]
+          uv sync --locked --no-build --extra dev
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
 
       - name: Run Linters and Formatters Check
         run: |
@@ -193,7 +210,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.92.0"
           components: rustfmt, clippy
@@ -252,15 +269,14 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - name: Set up uv with Python ${{ matrix.python-version }}
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
           python-version: ${{ matrix.python-version }}
-          cache: 'pip'
-          cache-dependency-path: 'pyproject.toml'
+          enable-cache: true
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.92.0"
           components: rustfmt, clippy
@@ -275,20 +291,16 @@ jobs:
           key: cargo-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('Cargo.lock') }}
           restore-keys: cargo-${{ runner.os }}-py${{ matrix.python-version }}-
 
-      - name: Install build backend
-        run: |
-          python -m pip install --upgrade pip
-          pip install "maturin>=1.10,<1.11"
-
       - name: Build and install diffctx (with Rust _diffctx) and dev deps
         shell: bash
         env:
           PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
         run: |
-          # PEP 660 editable install — maturin builds the Rust extension and
-          # pip installs everything (diffctx + [dev,full,mcp] extras). Skip build
-          # isolation since we just installed maturin in this env.
-          pip install -e ".[dev,full,mcp]" --no-build-isolation
+          # Editable install of the project plus every extra the suite needs.
+          # uv provisions maturin in its own build environment, so the build
+          # backend is not a separate step and cannot drift from pyproject.
+          uv sync --locked --no-build --extra dev --extra full --extra mcp
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
 
       - name: Run Tests with Coverage
         shell: bash
@@ -302,7 +314,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: runner.os == 'Linux' && matrix.python-version == '3.12'
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v5
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage.xml
@@ -332,15 +344,23 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
           python-version: '3.12'
+          enable-cache: true
+
+      # Installing this package compiles the native extension, so cargo must
+      # be on PATH at the pinned version.
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: "1.92.0"
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -e ".[dev]"
+          uv sync --locked --no-build --extra dev
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
 
       - name: Check cyclomatic complexity
         run: |
@@ -369,15 +389,23 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
           python-version: '3.12'
+          enable-cache: true
+
+      # Installing this package compiles the native extension, so cargo must
+      # be on PATH at the pinned version.
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: "1.92.0"
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -e ".[dev]"
+          uv sync --locked --no-build --extra dev
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
 
       - name: Check import contracts
         run: lint-imports

.github/workflows/eval-image.yml

@@ -39,7 +39,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
 
       - name: Login to ghcr
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0

.github/workflows/nightly-full-eval.yml

@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.92.0"
 

.github/workflows/publish-crate.yml

@@ -45,7 +45,7 @@ jobs:
           echo "Publishing diffctx $VERSION"
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c  # stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # stable
         with:
           toolchain: '1.92.0'
 

.github/workflows/publish-extras.yml

@@ -116,9 +116,19 @@ jobs:
             console.log('checksums.json: ' + n + ' assets, all version-tagged');
           "
 
+      # Idempotent like the PyPI step's skip-existing: a rerun after a
+      # smoke-only failure must not die on "cannot publish over previously
+      # published versions" (observed on 1.15.0).
       - name: Publish
         working-directory: ./packaging/npm
-        run: npm publish --access public --provenance
+        env:
+          VERSION: ${{ github.event.inputs.version }}
+        run: |
+          if npm view "diffctx@$VERSION" version >/dev/null 2>&1; then
+            echo "diffctx@$VERSION already on the registry; skipping publish"
+          else
+            npm publish --access public --provenance
+          fi
 
       # install.js is the script every `npx diffctx` runs, and nothing executed
       # it before this step existed. --ignore-scripts keeps npm from running
@@ -131,14 +141,21 @@ jobs:
           WORK=$(mktemp -d)
           cd "$WORK"
           npm init -y >/dev/null
-          for attempt in 1 2 3 4 5; do
+          installed=0
+          # Registry propagation took >100s on 1.15.0; without the installed
+          # guard the loop used to fall through to a MODULE_NOT_FOUND that
+          # hid the real failure.
+          for attempt in 1 2 3 4 5 6 7 8 9 10; do
             # Sonar S8543 (unlocked dependency versions) is marked false
             # positive in SonarCloud: VERSION is the exact just-published
             # version and the package has zero dependencies.
-            if npm install --ignore-scripts "diffctx@$VERSION"; then break; fi
+            if npm install --ignore-scripts "diffctx@$VERSION"; then installed=1; break; fi
             echo "npm registry not settled yet (attempt $attempt); retrying"
-            sleep 20
+            sleep 30
           done
+          if [ "$installed" != 1 ]; then
+            echo "diffctx@$VERSION never became installable"; exit 1
+          fi
           node node_modules/diffctx/install.js
           ./node_modules/.bin/diffctx --version
 
@@ -158,7 +175,7 @@ jobs:
           fi
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
 
       - name: Login to Docker Hub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0