[Mikola Lysenko (mikolalysenko)]

Problem

pins_for in crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs (and its twin in scripts/backtest-pdm.py) adds unearth<0.19 for every pdm 2.x release and hishel<2 for every release from 2.26.1. Upstream pdm has since moved past both:

pdm	declares	pin we add	result
2.29.2, 2.29.3	unearth>=0.17.5, hishel[httpx]>=1.0.0	both	ok (needed)
2.29.4 – 2.29.6	unearth>=0.19, hishel[httpx2]>=1.4.0	both	ResolutionImpossible (unearth)
2.29.7 (2026-11-06)	unearth>=0.19, hishel[httpx2]>=2.0	both	ResolutionImpossible (unearth and hishel)

So the pdm e2e cases fail before pdm even runs for any current release. CI is green today only because the matrix rows still run pdm 2.29.2 (ci.yml lines 1428, 2201). The next bump of the latest-pdm row, or a backtest of a current release, goes red. This is the same class of break as #2028 (hishel 2.0, which turned e2e_vex_build red on every PR) and #1738 (unearth 0.19): floating deps behind pdm. This PR stops the fixes for those breaks from causing the next one.

Fix

Apply each pin only to the releases that declare the unbounded requirement:

• unearth<0.19 only for pdm < 2.29.4
• hishel<2 only for 2.26.1 ≤ pdm < 2.29.7

The same bounds go into scripts/backtest-pdm.py. Nothing changes for the versions CI runs today (1.4.5, 1.15.5, 2.7.4, 2.8.2, 2.25.9, 2.29.2).

Proof

Real e2e_vex_build pdm cases (SOCKET_PATCH_PDM_E2E_REQUIRED=1 cargo test -p socket-patch-cli --test e2e_vex_build -- pdm:: --ignored), fresh tool caches:

pdm	origin/main	this branch
2.29.2 (matrix)	–	2 passed
2.29.4	2 failed (pip ResolutionImpossible)	2 passed
2.29.7	2 failed (pip ResolutionImpossible)	2 passed

Python pin table after the change: 2.25.9 → hishel<1, unearth<0.19; 2.29.2/2.29.3 → hishel<2, unearth<0.19; 2.29.4/2.29.6 → hishel<2; 2.29.7+ → none.

rustfmt --check on the touched file is clean. cargo clippy -p socket-patch-cli --test e2e_vex_build -- -D warnings reports one pre-existing needless_borrows_for_generic_args error in poetry.rs:473. This PR doesn't touch that file, and CI's clippy configuration doesn't flag it.

Where tests run

No test is added, removed or moved. Only the pdm bootstrap pins change.

Context (CI janitor run 2026-11-06 21:40 UTC)

The merge queue is empty and healthy, and main push and merge_group runs are green. The two nightly failures (gem CRLF source block on bundler 1.17/2.1, and pdm hishel) were fixed by #1999 and #2028 after last night's run. 15 open PRs are still red on the pdm leg because their heads predate #2028 and need origin/main merged in.

https://claude.ai/code/session_011f9aeQMSUtsXXCdCmmVd9T

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f0cac3e. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review by the burn-down agent.

• Head: f0cac3eb
• CI: 50/50 check runs settled green (31 success, 19 skipped)
• Bugbot: reviewed f0cac3e, no findings
• Reviewer note: the hishel and unearth bounds now stop at 2.29.7 and 2.29.4, where pdm itself requires hishel>=2 and unearth>=0.19. The e2e (pdm.rs) and backtest-pdm.py copies of pins_for match.
• Slack announcement could not be sent from this run (no Slack send tool available).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. The pdm e2e bootstrap (pins_for in the Rust e2e and its twin in scripts/backtest-pdm.py) now adds unearth<0.19 only for pdm < 2.29.4 and hishel<2 only for 2.26.1 ≤ pdm < 2.29.7. Newer pdm releases require unearth>=0.19 / hishel>=2, so the blanket pins made them uninstallable. Test-harness only; no product code changes.

Risk: low. Only test/backtest bootstrap pins move, and the pin set is unchanged for every pdm version CI runs today (1.4.5 … 2.29.2). The new upper bounds only take effect when a matrix row or backtest moves past 2.29.3.

Look here

• pdm.rs:139: hishel bound becomes 2.26.1..2.29.7
• pdm.rs:156: unearth pin gated on < 2.29.4
• backtest-pdm.py:212 and :219: same bounds in the Python twin

Verified. Read the full diff: the Rust and Python bounds match each other and the release table in the description; both compare 3-tuples like the existing branches. No CHANGELOG change, no debug leftovers, no scope creep. Merges cleanly into current main. CI on f0cac3eb: 31 passed, 19 skipped, 0 failed (ci-ok and clippy green). Bugbot: no issues. Note: CI can't exercise the new branches (its rows stop at 2.29.2); the description's manual runs on 2.29.4 and 2.29.7 are the evidence for them.

Changes I made. None.

Auto-merge (squash) is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code