Fails to install with uv

[jku]

https://github.com/astral-sh/uv currently fails to install protobuf-specs: theupdateframework/tuf-on-ci#205

• uv does not accept pre-releases without an explicit --prerelease=allow
• this project depends on betterproto 2.0.0b6

It's been about four years since 2.0.0b1 so waiting for betterproto to release might not be a good strategy. If we consider this important we could offer to do some work to the maintainer if that helps them make a release?

[woodruffw]

It's been about four years since 2.0.0b1 so waiting for betterproto to release might not be a good strategy. If we consider this important we could offer to do some work to the maintainer if that helps them make a release?

Yeah, this would be ideal -- I've sent a few patches upstream to betterproto (in particular, fixing the handling of the Struct WKT), but I don't know how close they are to a stable 2.0 release.

(In particular, I still need to complete the fix in danielgtaylor/python-betterproto#559, which I'm still slightly murky on.)

More generally though, prereleases are part of PEP 440 and uv should support them, at least when fully pinned (e.g. protobuf-specs==2.0.0b6). So I think it might also be good to prod uv into finishing their prerelease support 🙂

[spencerschrock]

This is also affecting users installing the model-signing library (from sigstore/model-transparency) either directly or indirectly with uv.

e.g. Kaggle/kagglehub#224 (comment)

As mentioned in the original comment, 2.0 of betterproto isn't known, and uv has stricter ideas of pre-release.
https://docs.astral.sh/uv/pip/compatibility/#pre-release-compatibility

In the future, uv may support pre-release identifiers in transitive dependencies. However, it's likely contingent on evolution in the Python packaging specifications. The existing PEPs do not cover "dependency resolution" and are instead focused on behavior for a single version specifier. As such, there are unresolved questions around the correct and intended behavior for pre-releases in the packaging ecosystem more broadly.

I don't follow PEPs too closely, so I don't know if anything has changed that would help uv "finish their prerelease support"?