[elijahr]

Pins headerkit==0.46.2 and headerkit[treesitter]==0.46.2 in pyproject.toml and uv.lock (matching the existing lockfile version) so upstream headerkit 0.47.1+ macro heuristic changes cannot break python-autopxd2 installations or TestZlibHeader::test_pxd_matches_expected.

[github-actions]

✅ Momus review posted — verdict APPROVE, 1 finding

████████████████████ 100%

run log

[github-actions]

This PR pins headerkit from >=0.46.2,<1.0.0 to ==0.46.2 in pyproject.toml and uv.lock, and fixes a stale lock-file version (4.0.1 → 4.0.2). The intent — preventing upstream headerkit 0.47.x from breaking macro heuristics — is reasonable, but the exact == pin is unnecessarily restrictive compared to a compatible-release pin (>=0.46.2,<0.47.0) that would equally block the 0.47.x breakage while permitting 0.46.x bugfix releases. One low-severity finding; otherwise the change is clean.

Severity tally: 1 Low.

Low

• BOT-A1 (pyproject.toml:34): Exact version pin ==0.46.2 is unnecessarily restrictive; compatible-release pin would serve the same purpose

Noteworthy

• Fixes a stale uv.lock version (4.0.1 → 4.0.2) left over from the v4.0.2 release commit.

Verdict: APPROVE.

Commands

• Comment /ai-review or mention @axiomantic-momus[bot] to request a re-review of the latest changes.
• Reply to a finding with won't fix, by design, or not a bug to decline it.
• Reply with instead, ... to propose an alternative fix.

Cost: $0.06 - 111,295 in / 9,221 out tokens - deepseek/deepseek-v4-pro

Powered by Momus running deepseek/deepseek-v4-pro via openrouter.ai.

[github-actions]

BOT-A1 — Low (quality)
Exact version pin ==0.46.2 is unnecessarily restrictive; compatible-release pin would serve the same purpose
The PR pins headerkit to '==0.46.2' (line 34: '"headerkit==0.46.2"' and line 41: '"headerkit[treesitter]==0.46.2"'). The stated reason is to prevent headerkit 0.47.1+ macro heuristic changes from breaking installations and tests. A compatible-release pin '>=0.46.2,<0.47.0' would equally block the 0.47.x breakage while still allowing 0.46.x bugfix releases (e.g., 0.46.3). The exact pin forces all consumers — including those installing autopxd2 alongside other packages that may require a 0.46.x bugfix — onto exactly 0.46.2, creating unnecessary dependency conflicts.

Suggested change

	"headerkit==0.46.2",
	]
	[project.optional-dependencies]
	# libclang backend (C++ support) - headerkit vendors clang bindings, kept for backwards compatibility
	libclang = []
	# tree-sitter backend - headerkit owns the tree-sitter dependency set
	treesitter = ["headerkit[treesitter]>=0.46.2,<1.0.0"]
	treesitter = ["headerkit[treesitter]==0.46.2"]
	headerkit>=0.46.2,<0.47.0