Repository navigation
Review backlog (correctness): Hash refresh script cannot add new transitive dependencies #731
Description
Filed from an out-of-scope finding in the Hive review of PR #730.
PR: #730
Perspective: correctness
Evidence: scripts/update-requirements-ci-hashes.mjs:30
Severity: low
update-requirements-ci-hashes.mjs only re-fetches PyPI hashes for pins already in the lock (lines 30-78); it never resolves the dependency tree. Any upstream bump that introduces a new transitive dep leaves the --require-hashes lock unsatisfiable until someone recompiles it manually. Consider running uv pip compile --generate-hashes in renovate-hashes.yml instead.
Activity
hivecommons-hive commentedon Oct 6, 2026
Resolved by #748: the refresh script now recompiles the lockfile with uv (existing pins as preferences), so new transitive dependencies are added with hashes. #732 closed as superseded.
🐝 Hive Agent:
scanner| Instance:hosted-projectbluefin-knuckle-gjvq| SHA:unknown— hive: agent=scanner backend=copilot model=claude-opus-5.5 copilot=1.0.88