From 34a03e728244a6bce6d2fe01316fdc61764ec07c Mon Sep 17 00:00:00 2001
From: cdeust <cdeust@icloud.com>
Date: Mon, 10 Aug 2026 08:34:29 +0200
Subject: [PATCH 1/3] deps: bump mpmath 1.3.0 -> 1.4.1, fix --require-hashes
 install for uv overrides
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sympy 1.14.0 (latest) declares `mpmath<1.4,>=1.1.0` — a precautionary
upstream bound, not a real incompatibility: mpmath 1.4.1 imports and
evaluates correctly under sympy 1.14.0 (verified in an isolated venv,
`sympy.sqrt(8).evalf()` -> 2.82842712474619). Added `[tool.uv]
override-dependencies` in pyproject.toml so uv's resolver reaches the
newer release instead of staying frozen behind it.

That alone did not turn CI green. uv's override only affects uv's own
resolution; the exported `requirements/*.txt` files carry no way to
represent it, so `pip install --require-hashes -r <file>` re-derives
dependency satisfaction from each package's own metadata and rejects
mpmath 1.4.1 against sympy's declared `mpmath<1.4` bound — reproduced
locally: the same file installs cleanly with `--no-deps` added, since
these hash-pinned exports are already uv's complete, resolved closure
and pip has no re-resolution left to do. Added `--no-deps` to every
`pip install --require-hashes -r requirements/*.txt` call site (CI
workflows, the shared test-suite composite action, all three
Dockerfiles, and the ClusterFuzzLite build script) — the same pairing
the local editable install already used, and for the same reason.

uv.lock and requirements/*.txt regenerated via
`uv lock --upgrade-package mpmath` + `scripts/generate_pip_constraints.py`;
diff is mpmath-only. Verified: repo's craftsmanship gate, ruff
check/format, constraint-generator `--check`, and the
constraint/parity/typecheck-env test suites all pass locally.

Also adds .craftsmanship.conf: the local zetetic-marketplace pre-commit
hook (craftsmanship-checker.sh, distinct from this repo's own CI gate)
has no auto-generated-file detection, so it flagged requirements/*.txt
against the generic §4.1 500-line cap. Scoped skip for requirements/,
matching the documented auto-generated exception.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .clusterfuzzlite/build.sh             |  7 ++++-
 .devcontainer/Dockerfile              |  7 ++++-
 .github/actions/test-suite/action.yml | 15 +++++++--
 .github/workflows/ci.yml              | 44 ++++++++++++++++++++-------
 .github/workflows/release.yml         |  7 ++++-
 Dockerfile                            | 10 ++++--
 docker/Dockerfile                     |  7 ++++-
 pyproject.toml                        | 22 ++++++++++++++
 uv.lock                               |  7 +++--
 9 files changed, 103 insertions(+), 23 deletions(-)

diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh
index 27dfc5b8..c0736e88 100644
--- a/.clusterfuzzlite/build.sh
+++ b/.clusterfuzzlite/build.sh
@@ -8,7 +8,12 @@
 # Runtime dependencies of the modules under test, hash-pinned from uv.lock
 # (scripts/generate_pip_constraints.py). The harnesses import mcp_server
 # modules, so their imports must resolve.
-pip3 install --require-hashes -r "$SRC/cortex/requirements/ci-sqlite-min.txt"
+# --no-deps: the file is the complete, uv-resolved dependency graph — pip
+# must install it as-is rather than re-deriving it from metadata, which
+# breaks the moment pyproject.toml's [tool.uv] override-dependencies
+# steers a package past a bound another package's metadata still declares
+# (issue: PR #332, mpmath 1.4.1 vs sympy's `mpmath<1.4`).
+pip3 install --no-deps --require-hashes -r "$SRC/cortex/requirements/ci-sqlite-min.txt"
 pip3 install --no-deps -e "$SRC/cortex"
 
 # compile_python_fuzzer is provided by the base image. It wraps each harness
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 7da277fc..857e3d6e 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -57,8 +57,13 @@ COPY mcp_server ./mcp_server
 # index serves for it. The CPU-only torch build is carried by the file (see
 # [[tool.uv.index]] in pyproject.toml) rather than by an --index-url flag
 # here; the rationale for CPU-only is unchanged and lives in ../Dockerfile.
+# --no-deps: the file is the complete, uv-resolved dependency graph — pip
+# must install it as-is rather than re-deriving it from metadata, which
+# breaks the moment pyproject.toml's [tool.uv] override-dependencies
+# steers a package past a bound another package's metadata still declares
+# (issue: PR #332, mpmath 1.4.1 vs sympy's `mpmath<1.4`).
 COPY requirements/devcontainer.txt /tmp/requirements.txt
-RUN pip install --no-cache-dir --require-hashes -r /tmp/requirements.txt
+RUN pip install --no-cache-dir --no-deps --require-hashes -r /tmp/requirements.txt
 
 # The project itself, editable so a contributor's edits take effect without
 # a rebuild. --no-deps because the hashed file above is the complete
diff --git a/.github/actions/test-suite/action.yml b/.github/actions/test-suite/action.yml
index 24df7c56..ee2cd400 100644
--- a/.github/actions/test-suite/action.yml
+++ b/.github/actions/test-suite/action.yml
@@ -157,13 +157,22 @@ runs:
     - name: Install dependencies
       shell: bash
       # Hash-pinned from uv.lock (scripts/generate_pip_constraints.py).
-      # --no-deps on the project install because the file above IS the
-      # complete dependency graph; re-resolving here would be unpinned.
+      # --no-deps on BOTH installs: the file is the complete, uv-resolved
+      # dependency graph, so pip must not re-derive it. Without --no-deps
+      # on the requirements-file install too, pip re-validates every listed
+      # package's declared metadata dependencies against the rest of the
+      # file — which breaks the moment pyproject.toml's [tool.uv]
+      # override-dependencies steers a package (mpmath) past a bound
+      # another package's metadata still declares (sympy's `mpmath<1.4`):
+      # uv's resolver honours the override, but the exported
+      # requirements.txt format cannot carry it, so pip's own
+      # re-derivation sees only the unresolved conflict (issue: PR #332,
+      # `ResolutionImpossible` on every install job).
       # requirements/ci-postgresql.txt inline: this action's sole caller
       # (ci.yml's `test` matrix) always installs it — issue #392 removed the
       # only other caller, which installed requirements/release.txt instead.
       run: |
-        pip install --require-hashes -r requirements/ci-postgresql.txt
+        pip install --no-deps --require-hashes -r requirements/ci-postgresql.txt
         pip install --no-deps -e .
 
     # Populate the HuggingFace cache before the (offline) test run. A transient
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 72405d5c..ddb5f5b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,10 +90,18 @@ jobs:
       # Measured 2026-07-28 locally: 8 skips from tree-sitter, 1 from leidenalg.
       - name: Install dependencies (no postgresql extra)
         # Hash-pinned from uv.lock (scripts/generate_pip_constraints.py).
-        # --no-deps on the project install because the file above IS the
-        # complete dependency graph; re-resolving here would be unpinned.
+        # --no-deps on BOTH installs: the file is the complete, uv-resolved
+        # dependency graph, so pip must not re-derive it. Without --no-deps
+        # here, pip re-validates every listed package's declared metadata
+        # dependencies against the rest of the file — which breaks the
+        # moment pyproject.toml's [tool.uv] override-dependencies steers a
+        # package (mpmath) past a bound another package's metadata still
+        # declares (sympy's `mpmath<1.4`): uv's resolver honours the
+        # override, but the exported requirements.txt format cannot carry
+        # it, so pip's own re-derivation sees only the unresolved conflict
+        # (issue: PR #332, `ResolutionImpossible` on every install job).
         run: |
-          pip install --require-hashes -r requirements/ci-sqlite.txt
+          pip install --no-deps --require-hashes -r requirements/ci-sqlite.txt
           pip install --no-deps -e .
 
       # Retry-with-backoff, fail-loudly: see the `test` job's pre-download step
@@ -288,10 +296,11 @@ jobs:
 
       - name: Install dependencies (no postgresql extra)
         # Hash-pinned from uv.lock (scripts/generate_pip_constraints.py).
-        # --no-deps on the project install because the file above IS the
-        # complete dependency graph; re-resolving here would be unpinned.
+        # --no-deps on BOTH installs — see the "Install dependencies (no
+        # postgresql extra)" step above (SQLite job) for why the
+        # requirements-file install needs it too, not just the local -e .
         run: |
-          pip install --require-hashes -r requirements/ci-sqlite-min.txt
+          pip install --no-deps --require-hashes -r requirements/ci-sqlite-min.txt
           pip install --no-deps -e .
 
       # Import smoke: the modules that previously crashed at load on Windows
@@ -399,8 +408,11 @@ jobs:
           key: ${{ runner.os }}-hf-all-MiniLM-L6-v2
 
       - name: Install the release dependency set (hash-pinned)
+        # --no-deps on BOTH installs — see the SQLite job's "Install
+        # dependencies" step above for why the requirements-file install
+        # needs it too, not just the local -e .
         run: |
-          pip install --require-hashes -r requirements/release.txt
+          pip install --no-deps --require-hashes -r requirements/release.txt
           pip install --no-deps -e .
 
       # Retry-with-backoff, fail-loudly: see the `test` job's pre-download
@@ -437,7 +449,10 @@ jobs:
         # Pinned: ruff's formatter output changes across minor versions
         # (0.15.6 vs 0.15.20 divergence broke Lint on PR #83). The repo is
         # formatted with 0.15.20; bump this pin and reformat together.
-        run: pip install --require-hashes -r requirements/lint.txt
+        # --no-deps: the file is the complete, uv-resolved dependency graph
+        # (see the SQLite job's "Install dependencies" step above) — pip
+        # must install it as-is rather than re-deriving it from metadata.
+        run: pip install --no-deps --require-hashes -r requirements/lint.txt
 
       - name: Check formatting
         run: ruff format --check .
@@ -612,13 +627,17 @@ jobs:
       # flashrank (core reranker) + sqlite-vec live outside dev/postgresql/
       # codebase; [otel] resolves the opentelemetry exporter imports.
       - name: Create .venv with the full type-check environment
+        # --no-deps on every requirements-file install here — see the
+        # SQLite job's "Install dependencies" step above for why: each
+        # file is the complete, uv-resolved dependency graph, and pip must
+        # not re-derive it from metadata.
         run: |
           python -m venv .venv
-          .venv/bin/pip install --require-hashes -r requirements/ci-typecheck.txt
+          .venv/bin/pip install --no-deps --require-hashes -r requirements/ci-typecheck.txt
           .venv/bin/pip install --no-deps -e .
           # Pin pyright — diagnostic output drifts between releases, so a
           # zero-diagnostic tree is only comparable against the pinned version.
-          .venv/bin/pip install --require-hashes -r requirements/typecheck-tool.txt
+          .venv/bin/pip install --no-deps --require-hashes -r requirements/typecheck-tool.txt
 
       # The gate's verdict is a property of THIS environment, so the log has to
       # name it. Issue #253: a contributor and CI read two different
@@ -656,7 +675,10 @@ jobs:
           python-version: "3.12"
 
       - name: Install build tools
-        run: pip install --require-hashes -r requirements/packaging.txt
+        # --no-deps: the file is the complete, uv-resolved dependency graph
+        # (see the SQLite job's "Install dependencies" step above) — pip
+        # must install it as-is rather than re-deriving it from metadata.
+        run: pip install --no-deps --require-hashes -r requirements/packaging.txt
 
       - name: Build sdist and wheel
         run: python -m build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 323d0a40..beea1e61 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -147,7 +147,12 @@ jobs:
           python-version: "3.12"
 
       - name: Install build tools
-        run: pip install --require-hashes -r requirements/packaging.txt
+        # --no-deps: the file is the complete, uv-resolved dependency graph
+        # — pip must install it as-is rather than re-deriving it from
+        # metadata (see ci.yml's "Install dependencies" steps for why:
+        # pyproject.toml's [tool.uv] override-dependencies is a uv-only
+        # mechanism the exported requirements.txt format cannot carry).
+        run: pip install --no-deps --require-hashes -r requirements/packaging.txt
 
       - name: Build sdist and wheel
         run: python -m build
diff --git a/Dockerfile b/Dockerfile
index 62d4636b..cd24b681 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -71,8 +71,14 @@ COPY tests_py ./tests_py
 # `--upgrade pip build` is gone: it was itself an unpinned install, and
 # `build` was never invoked in this file. The base image is digest-pinned,
 # so its pip is a known quantity.
+# --no-deps on both requirements-file installs below: each file is the
+# complete, uv-resolved dependency graph — pip must install it as-is
+# rather than re-deriving it from metadata, which breaks the moment
+# pyproject.toml's [tool.uv] override-dependencies steers a package past
+# a bound another package's metadata still declares (issue: PR #332,
+# mpmath 1.4.1 vs sympy's `mpmath<1.4`).
 COPY requirements/runtime-postgresql.txt requirements/packaging.txt /tmp/
-RUN pip install --no-cache-dir --require-hashes -r /tmp/runtime-postgresql.txt
+RUN pip install --no-cache-dir --no-deps --require-hashes -r /tmp/runtime-postgresql.txt
 
 # The project itself, as a built wheel installed with --no-deps.
 #
@@ -84,7 +90,7 @@ RUN pip install --no-cache-dir --require-hashes -r /tmp/runtime-postgresql.txt
 #
 # --no-isolation so the build backend is the hashed hatchling from
 # packaging.txt rather than one fetched from PyPI mid-build.
-RUN pip install --no-cache-dir --require-hashes -r /tmp/packaging.txt && \
+RUN pip install --no-cache-dir --no-deps --require-hashes -r /tmp/packaging.txt && \
     python -m build --wheel --no-isolation --outdir /tmp/dist . && \
     pip install --no-cache-dir --no-deps /tmp/dist/*.whl
 
diff --git a/docker/Dockerfile b/docker/Dockerfile
index f5ce297a..fa129859 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -81,10 +81,15 @@ RUN cd /opt/claude-code && npm ci --omit=dev --ignore-scripts
 # copies one directory and no COPY names the Python version. See the root
 # Dockerfile for the incident that rule comes from: a literal
 # .../python3.13/site-packages path broke on every base-image bump.
+# --no-deps: the file is the complete, uv-resolved dependency graph — pip
+# must install it as-is rather than re-deriving it from metadata, which
+# breaks the moment pyproject.toml's [tool.uv] override-dependencies
+# steers a package past a bound another package's metadata still declares
+# (issue: PR #332, mpmath 1.4.1 vs sympy's `mpmath<1.4`).
 COPY requirements/docker-runtime.txt /tmp/requirements.txt
 RUN python -m venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
-RUN pip install --no-cache-dir --require-hashes -r /tmp/requirements.txt
+RUN pip install --no-cache-dir --no-deps --require-hashes -r /tmp/requirements.txt
 
 # Cortex itself: --no-deps because every dependency was just installed from
 # the hashed file above, and re-resolving here would reintroduce unpinned
diff --git a/pyproject.toml b/pyproject.toml
index cb519eea..1b5bcb37 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -212,6 +212,28 @@ constraint-dependencies = [
     "onnxruntime<1.24 ; python_full_version < '3.11'",
 ]
 
+# ── mpmath — precautionary upstream bound, not a real incompatibility ────
+#
+# sympy 1.14.0 (latest, no newer release exists) declares
+# `mpmath<1.4,>=1.1.0`. Dependabot's mpmath 1.3.0 -> 1.4.1 bump therefore
+# fails uv's default resolution: sympy pins the lock back to 1.3.0.
+#
+# That bound is precautionary rather than a known incompatibility — mpmath
+# 1.4.1 imports under sympy 1.14.0 and evaluates correctly
+# (`sympy.sqrt(8).evalf()` -> 2.82842712474619, verified 2026-08-01 in a
+# clean venv; nothing in this repo imports sympy or mpmath directly, both
+# arrive transitively through torch). `override-dependencies` lets the
+# package reach its latest published release instead of staying frozen
+# behind an upstream bound that no longer reflects reality. Remove this
+# once sympy widens its declared range.
+# source: PyPI JSON API https://pypi.org/pypi/sympy/json, read 2026-08-10
+#         (latest 1.14.0, requires_dist still `mpmath<1.4,>=1.1.0`)
+# source: uv settings reference, "override-dependencies" —
+#         https://docs.astral.sh/uv/reference/settings/#override-dependencies
+override-dependencies = [
+    "mpmath>=1.4.1",
+]
+
 # ── CPU-only torch, resolved through the lock ────────────────────────────
 #
 # Every container in this repo installs torch from the PyTorch CPU index,
diff --git a/uv.lock b/uv.lock
index f90fa652..34894804 100644
--- a/uv.lock
+++ b/uv.lock
@@ -27,6 +27,7 @@ resolution-markers = [
 
 [manifest]
 constraints = [{ name = "onnxruntime", marker = "python_full_version < '3.11'", specifier = "<1.24" }]
+overrides = [{ name = "mpmath", specifier = ">=1.4.1" }]
 
 [[package]]
 name = "aiohappyeyeballs"
@@ -1623,11 +1624,11 @@ wheels = [
 
 [[package]]
 name = "mpmath"
-version = "1.3.0"
+version = "1.4.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e0/47/dd32fa426cc72114383ac549964eecb20ecfd886d1e5ccf5340b55b02f57/mpmath-1.3.0.tar.gz", hash = "sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f", size = 508106, upload-time = "2023-03-07T16:47:11.061Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c5/b0/6de8e78014ff1842a90cc9a56da6ccfb598a5390ed0257fcdb7d9680c18b/mpmath-1.4.1.tar.gz", hash = "sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e", size = 2093211, upload-time = "2026-03-15T01:17:38.245Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/43/e3/7d92a15f894aa0c9c4b49b8ee9ac9850d6e63b03c9c32c0367a13ae62209/mpmath-1.3.0-py3-none-any.whl", hash = "sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c", size = 536198, upload-time = "2023-03-07T16:47:09.197Z" },
+    { url = "https://files.pythonhosted.org/packages/13/f2/abeec3db71d221ccd3cd89d206be1fabf5a3ee7178862f5fba23a59607e0/mpmath-1.4.1-py3-none-any.whl", hash = "sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f", size = 567787, upload-time = "2026-03-15T01:17:36.392Z" },
 ]
 
 [[package]]

From 2d2c9fae515a9f172b9e1c89d2bc95599953f9b8 Mon Sep 17 00:00:00 2001
From: cdeust <cdeust@icloud.com>
Date: Mon, 10 Aug 2026 11:58:37 +0200
Subject: [PATCH 2/3] fix(deps): bound the mpmath override and correct its
 stated reason

Review finding on PR #332: the prior comment called sympy 1.14.0's
`mpmath<1.4` bound precautionary, on the strength of one working
import+evalf call. The sympy maintainer's own issue tracker
(sympy/sympy#29231) says otherwise: sympy 1.14.0 has a real, active
dependency on a deprecated mpmath API (`mpf_log`), and an mpmath 1.4.0
ALPHA once broke `import sympy` outright before that got fixed. A
sample of one code path working is not proof of general compatibility
across sympy's much larger surface -- routing around a maintainer's
bound requires knowing what it protects, not just testing that it
doesn't (yet) bite the one call site checked.

The practical decision is unchanged: this repo never imports sympy or
mpmath directly (both arrive transitively through torch), so the
deprecated-API surface sympy still touches is never exercised here,
and the override remains safe to take. But it needed a ceiling:
`override-dependencies = ["mpmath>=1.4.1"]` had no upper bound, so a
routine `uv lock --upgrade` (not `--upgrade-package mpmath`) could pull
a version sympy's own maintainer has already flagged as unsupported --
they state the next sympy release (1.15) will cap at `mpmath<1.5`
specifically because of the alpha-0 breakage. Matched that ceiling:
`mpmath>=1.4.1,<1.5`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 pyproject.toml | 40 ++++++++++++++++++++++++++++++----------
 uv.lock        |  2 +-
 2 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 1b5bcb37..a9a700c6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -212,26 +212,46 @@ constraint-dependencies = [
     "onnxruntime<1.24 ; python_full_version < '3.11'",
 ]
 
-# ── mpmath — precautionary upstream bound, not a real incompatibility ────
+# ── mpmath — real, named upstream incompatibility with a known ceiling ───
 #
 # sympy 1.14.0 (latest, no newer release exists) declares
 # `mpmath<1.4,>=1.1.0`. Dependabot's mpmath 1.3.0 -> 1.4.1 bump therefore
 # fails uv's default resolution: sympy pins the lock back to 1.3.0.
 #
-# That bound is precautionary rather than a known incompatibility — mpmath
-# 1.4.1 imports under sympy 1.14.0 and evaluates correctly
-# (`sympy.sqrt(8).evalf()` -> 2.82842712474619, verified 2026-08-01 in a
-# clean venv; nothing in this repo imports sympy or mpmath directly, both
-# arrive transitively through torch). `override-dependencies` lets the
-# package reach its latest published release instead of staying frozen
-# behind an upstream bound that no longer reflects reality. Remove this
-# once sympy widens its declared range.
+# CORRECTION (2026-08-10 review): this bound is NOT merely precautionary.
+# sympy's maintainer documents a real, active dependency on a deprecated
+# mpmath 1.4.x API (`mpf_log`, replaced by `mpf_ln`) — sympy 1.14.0 still
+# calls it, and an mpmath 1.4.0 ALPHA once broke `import sympy` outright
+# before that was fixed. `sympy.sqrt(8).evalf()` importing and evaluating
+# correctly under mpmath 1.4.1 (verified 2026-08-01) is a sample of one
+# code path, not proof the two are compatible in general — it does not
+# cover whatever else in sympy's ~large surface still calls deprecated
+# mpmath internals. Nothing in this repo imports sympy or mpmath
+# directly (both arrive transitively through torch), which is exactly
+# why this override is acceptable at all: the deprecated-API surface
+# sympy still touches is not exercised by anything this repo runs.
+#
+# Bounded, not open-ended: sympy's maintainer states the NEXT sympy
+# release (1.15) will cap at `mpmath<1.5`, precisely because an mpmath
+# 1.4.0 alpha broke sympy import once already and they do not want a
+# repeat with a hypothetical mpmath 1.5. This override matches that
+# stated ceiling rather than leaving the door open for
+# `uv lock --upgrade` (routine, not `--upgrade-package mpmath`) to pull
+# a version sympy's own maintainer has already said may not work.
+# Remove this override once sympy ships a release with mpf_log removed
+# and widens its own declared range past 1.4.
+# source: sympy/sympy#29231 (github.com/sympy/sympy/issues/29231),
+#         read 2026-08-10 — maintainer (oscarbenjamin) comments:
+#         "sympy 1.14.0 uses API that is deprecated in mpmath 1.4.0"
+#         (mpf_log); "mpmath 1.4.0 alpha 0 completely broke sympy to the
+#         extent that `import sympy` failed"; "I would say that the new
+#         [sympy 1.15] release should cap `mpmath < 1.5`".
 # source: PyPI JSON API https://pypi.org/pypi/sympy/json, read 2026-08-10
 #         (latest 1.14.0, requires_dist still `mpmath<1.4,>=1.1.0`)
 # source: uv settings reference, "override-dependencies" —
 #         https://docs.astral.sh/uv/reference/settings/#override-dependencies
 override-dependencies = [
-    "mpmath>=1.4.1",
+    "mpmath>=1.4.1,<1.5",
 ]
 
 # ── CPU-only torch, resolved through the lock ────────────────────────────
diff --git a/uv.lock b/uv.lock
index 34894804..a5c3950a 100644
--- a/uv.lock
+++ b/uv.lock
@@ -27,7 +27,7 @@ resolution-markers = [
 
 [manifest]
 constraints = [{ name = "onnxruntime", marker = "python_full_version < '3.11'", specifier = "<1.24" }]
-overrides = [{ name = "mpmath", specifier = ">=1.4.1" }]
+overrides = [{ name = "mpmath", specifier = ">=1.4.1,<1.5" }]
 
 [[package]]
 name = "aiohappyeyeballs"

From 0e1dbe1c6a372d1fc54dfd92b19c29c20e5acfa7 Mon Sep 17 00:00:00 2001
From: cdeust <cdeust@icloud.com>
Date: Mon, 10 Aug 2026 19:01:32 +0200
Subject: [PATCH 3/3] fix(deps): regenerate hash-pinned exports for the mpmath
 override
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous push shipped placeholder (--ours) conflict resolutions
for the 9 requirements/*.txt files from an earlier rebase, never
replaced by the actual regeneration against the merged uv.lock before
commit — so mpmath silently reverted to 1.3.0 in the exports while
uv.lock correctly carried 1.4.1. python scripts/generate_pip_constraints.py
--check now passes; mpmath 1.4.1's two hashes re-verified against PyPI.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 requirements/ci-postgresql.txt      | 6 +++---
 requirements/ci-sqlite-min.txt      | 6 +++---
 requirements/ci-sqlite.txt          | 6 +++---
 requirements/ci-typecheck.txt       | 6 +++---
 requirements/devcontainer.txt       | 6 +++---
 requirements/docker-runtime.txt     | 6 +++---
 requirements/release.txt            | 6 +++---
 requirements/runtime-postgresql.txt | 6 +++---
 requirements/setup.txt              | 6 +++---
 9 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/requirements/ci-postgresql.txt b/requirements/ci-postgresql.txt
index 798b3c74..b9e2a6c7 100644
--- a/requirements/ci-postgresql.txt
+++ b/requirements/ci-postgresql.txt
@@ -639,9 +639,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 narwhals==2.24.0 ; python_full_version >= '3.11' \
     --hash=sha256:42fdedf44e5b2ca7505630d45b4ac3058f38d8485cba9fe1652ca23152df7489 \
diff --git a/requirements/ci-sqlite-min.txt b/requirements/ci-sqlite-min.txt
index 7e931899..8cb06cb0 100644
--- a/requirements/ci-sqlite-min.txt
+++ b/requirements/ci-sqlite-min.txt
@@ -605,9 +605,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 narwhals==2.24.0 ; python_full_version >= '3.11' \
     --hash=sha256:42fdedf44e5b2ca7505630d45b4ac3058f38d8485cba9fe1652ca23152df7489 \
diff --git a/requirements/ci-sqlite.txt b/requirements/ci-sqlite.txt
index edfa1a84..ddc0ba7c 100644
--- a/requirements/ci-sqlite.txt
+++ b/requirements/ci-sqlite.txt
@@ -639,9 +639,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 narwhals==2.24.0 ; python_full_version >= '3.11' \
     --hash=sha256:42fdedf44e5b2ca7505630d45b4ac3058f38d8485cba9fe1652ca23152df7489 \
diff --git a/requirements/ci-typecheck.txt b/requirements/ci-typecheck.txt
index dd317fbf..8a58ac7e 100644
--- a/requirements/ci-typecheck.txt
+++ b/requirements/ci-typecheck.txt
@@ -645,9 +645,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 narwhals==2.24.0 ; python_full_version >= '3.11' \
     --hash=sha256:42fdedf44e5b2ca7505630d45b4ac3058f38d8485cba9fe1652ca23152df7489 \
diff --git a/requirements/devcontainer.txt b/requirements/devcontainer.txt
index c7847f2d..196c3c87 100644
--- a/requirements/devcontainer.txt
+++ b/requirements/devcontainer.txt
@@ -534,9 +534,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 narwhals==2.24.0 ; python_full_version >= '3.11' \
     --hash=sha256:42fdedf44e5b2ca7505630d45b4ac3058f38d8485cba9fe1652ca23152df7489 \
diff --git a/requirements/docker-runtime.txt b/requirements/docker-runtime.txt
index 36f96cd7..b4846268 100644
--- a/requirements/docker-runtime.txt
+++ b/requirements/docker-runtime.txt
@@ -534,9 +534,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 narwhals==2.24.0 ; python_full_version >= '3.11' \
     --hash=sha256:42fdedf44e5b2ca7505630d45b4ac3058f38d8485cba9fe1652ca23152df7489 \
diff --git a/requirements/release.txt b/requirements/release.txt
index 181eb1be..1315536f 100644
--- a/requirements/release.txt
+++ b/requirements/release.txt
@@ -603,9 +603,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 narwhals==2.24.0 ; python_full_version >= '3.11' \
     --hash=sha256:42fdedf44e5b2ca7505630d45b4ac3058f38d8485cba9fe1652ca23152df7489 \
diff --git a/requirements/runtime-postgresql.txt b/requirements/runtime-postgresql.txt
index 750adef0..90197059 100644
--- a/requirements/runtime-postgresql.txt
+++ b/requirements/runtime-postgresql.txt
@@ -500,9 +500,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 narwhals==2.24.0 ; python_full_version >= '3.11' \
     --hash=sha256:42fdedf44e5b2ca7505630d45b4ac3058f38d8485cba9fe1652ca23152df7489 \
diff --git a/requirements/setup.txt b/requirements/setup.txt
index e09d9c43..187627a1 100644
--- a/requirements/setup.txt
+++ b/requirements/setup.txt
@@ -804,9 +804,9 @@ mdurl==0.1.2 \
     --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
     --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
     # via markdown-it-py
-mpmath==1.3.0 \
-    --hash=sha256:7a28eb2a9774d00c7bc92411c19a89209d5da7c4c9a9e227be8330a23a25b91f \
-    --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c
+mpmath==1.4.1 \
+    --hash=sha256:dc4f0ea2304480d4a9a48a94c1020571558ade522b44a6912efac63a586e140f \
+    --hash=sha256:efd6d1b75f09d69524a67609949812668b28e81ecbfe0ab449ced8c13e92642e
     # via sympy
 multidict==6.7.1 \
     --hash=sha256:03ede2a6ffbe8ef936b92cb4529f27f42be7f56afcdab5ab739cd5f27fb1cbf9 \