requirements.lock inconsistent with requirements-dev.lock

[gmacon]

Steps to Reproduce

rye init
rye add langhain
rye add --dev langchain-community

This happens today (2024-11-25), but might not happen in the future if newer versions of langchain and/or langchain-community happen. The relevant thing about those packages is that langchain declares SQLAlchemy = ">=1.4,<3" but langhain-community declares SQLAlchemy = ">=1.4,<2.0.36".

(Aside: langchain-community provides, among other things, a "fake" LLM that we use for writing tests, which is why it is only a dev dependency.)

Expected Result

The requirements-dev.lock is a strict superset of requirements.lock. Specifically, requirements-dev.lock can contain additional packages that don't exist in requirements.lock, but it shouldn't contain a different version of a package that exists in requirements.lock.

Actual Result

requirements.dev contains sqlalchemy==2.0.36 but requirements-dev.lock contains sqlalchemy==2.0.35. Full results.

Version Info

rye 0.42.0
commit: 0.42.0 (1980-01-01)
platform: linux (x86_64)
self-python: cpython@3.12.3
symlink support: true
uv enabled: true

Stacktrace

No response