From caf01735faad7288347f15d7683a5e324205ba5c Mon Sep 17 00:00:00 2001
From: Charlie Marsh <charlie.r.marsh@gmail.com>
Date: Sun, 28 Jul 2024 14:35:18 -0400
Subject: [PATCH] Avoid warning users for missing self-extra lower bounds
 (#5518)

## Summary

Closes https://github.com/astral-sh/uv/issues/5227.
---
 .../uv-resolver/src/pubgrub/dependencies.rs   |  2 +-
 crates/uv-resolver/src/resolver/mod.rs        |  2 +-
 crates/uv/tests/lock.rs                       | 34 +++++++++++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/crates/uv-resolver/src/pubgrub/dependencies.rs b/crates/uv-resolver/src/pubgrub/dependencies.rs
index ab9243213..3af4458bf 100644
--- a/crates/uv-resolver/src/pubgrub/dependencies.rs
+++ b/crates/uv-resolver/src/pubgrub/dependencies.rs
@@ -79,7 +79,7 @@ impl PubGrubDependency {
                             package: package.clone(),
                             version: version.clone(),
                             specifier,
-                            url: None,
+                            url,
                         })
                     }
                     _ => None,
diff --git a/crates/uv-resolver/src/resolver/mod.rs b/crates/uv-resolver/src/resolver/mod.rs
index 4738f41e9..333f6f91c 100644
--- a/crates/uv-resolver/src/resolver/mod.rs
+++ b/crates/uv-resolver/src/resolver/mod.rs
@@ -2135,7 +2135,7 @@ impl ForkState {
                 // A dependency from the root package or requirements.txt.
                 debug!("Adding direct dependency: {package}{version}");
 
-                // Warn the user if the direct dependency lacks a lower bound in lowest resolution.
+                // Warn the user if a direct dependency lacks a lower bound in `--lowest` resolution.
                 let missing_lower_bound = version
                     .bounding_range()
                     .map(|(lowest, _highest)| lowest == Bound::Unbounded)
diff --git a/crates/uv/tests/lock.rs b/crates/uv/tests/lock.rs
index fecc6d634..dd9127fa3 100644
--- a/crates/uv/tests/lock.rs
+++ b/crates/uv/tests/lock.rs
@@ -4105,3 +4105,37 @@ fn lock_same_version_multiple_urls() -> Result<()> {
 
     Ok(())
 }
+
+/// When locking with `--resolution-mode=lowest`, we shouldn't warn on unbounded direct
+/// dependencies.
+#[test]
+fn lock_unsafe_lowest() -> Result<()> {
+    let context = TestContext::new("3.12");
+
+    let pyproject_toml = context.temp_dir.child("pyproject.toml");
+    pyproject_toml.write_str(
+        r#"
+        [project]
+        name = "project"
+        version = "0.1.0"
+        requires-python = ">=3.12"
+        dependencies = []
+
+        [project.optional-dependencies]
+        dev = ["iniconfig"]
+        all = ["project[dev]"]
+        "#,
+    )?;
+
+    uv_snapshot!(context.filters(), context.lock().arg("--resolution").arg("lowest-direct"), @r###"
+    success: true
+    exit_code: 0
+    ----- stdout -----
+
+    ----- stderr -----
+    warning: `uv lock` is experimental and may change without warning
+    Resolved 2 packages in [TIME]
+    "###);
+
+    Ok(())
+}