0.48.2-RC1 (option A): merge master into version/0-48-2-RC1

.github/workflows/build.yml

@@ -8,6 +8,7 @@ name: Build-Test-Deploy
       - beta
       - release
       - LTS*
+      - mcp
   pull_request:
     types:
       - labeled
@@ -188,7 +189,7 @@ jobs:
         name: Check Format
         id: check_format
         shell: bash
-        if: "!contains(fromJSON('[\"refs/heads/beta\", \"refs/heads/release\", \"refs/heads/LTS\", \"refs/heads/master\"]'), github.ref) && !startsWith(github.event.pull_request.head.ref, 'version/')"
+        if: "!contains(fromJSON('[\"refs/heads/beta\", \"refs/heads/release\", \"refs/heads/LTS\", \"refs/heads/master\", \"refs/heads/mcp\"]'), github.ref) && !startsWith(github.event.pull_request.head.ref, 'version/')"
         run: parallelize results Check-Format
 
       - # === Raw Unit Tests ===
@@ -261,7 +262,7 @@ jobs:
 
       - # === Deploy for Integration Tests # NEVER run this against production branches. This is meant for PR deployments. ===
         name: Deploy for Integration Tests # NEVER run this against production branches. This is meant for PR deployments.
-        if: "!contains(fromJSON('[\"refs/heads/beta\", \"refs/heads/release\", \"refs/heads/LTS\"]'), github.ref)"
+        if: "!contains(fromJSON('[\"refs/heads/beta\", \"refs/heads/release\", \"refs/heads/LTS\", \"refs/heads/mcp\"]'), github.ref)"
         shell: bash
         run: |
           if [ "$GITHUB_EVENT_NAME" != "schedule" ]; then
@@ -287,7 +288,7 @@ jobs:
       - # === Integration Tests ===
         name: Integration Tests
         id: integration_tests
-        if: "!contains(fromJSON('[\"refs/heads/beta\", \"refs/heads/release\", \"refs/heads/LTS\"]'), github.ref)"
+        if: "!contains(fromJSON('[\"refs/heads/beta\", \"refs/heads/release\", \"refs/heads/LTS\", \"refs/heads/mcp\"]'), github.ref)"
         shell: bash
         run: |
           export CGO_ENABLED=0
@@ -428,7 +429,7 @@ jobs:
       GITHUB_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GITHUB_SHA_OVERRIDE: ${{ github.event.pull_request.head.sha || github.sha }}
     timeout-minutes: 10
-    if: contains(fromJSON('["refs/heads/master", "refs/heads/beta", "refs/heads/release", "refs/heads/LTS"]'), github.ref) || startsWith(github.event.pull_request.head.ref, 'version/')
+    if: contains(fromJSON('["refs/heads/master", "refs/heads/beta", "refs/heads/release", "refs/heads/LTS", "refs/heads/mcp"]'), github.ref) || startsWith(github.event.pull_request.head.ref, 'version/')
 
     # === Deploy Steps ===
     steps:

activestate.yaml

@@ -295,15 +295,15 @@ scripts:
     value: |
       set -e
       $constants.SET_ENV
-      
+
       PREFIX="remote-installer"
       if [ "$DEPLOY_TO_STAGING" = "true" ]; then
         PREFIX="staging/$PREFIX"
         echo "Deploying remote installer to staging: $PREFIX"
       else
         echo "Deploying remote installer to production: $PREFIX"
       fi
-      
+
       go run scripts/ci/s3-deployer/main.go $BUILD_TARGET_DIR/remote-installer us-east-1 state-tool $PREFIX
   - name: promote-staging-to-production
     language: bash
@@ -319,8 +319,8 @@ scripts:
         echo "Promotion cancelled."
         exit 1
       fi
-      
-      go run scripts/ci/s3-promoter/main.go us-east-1 state-tool
+
+      go run scripts/ci/s3-promoter/main.go us-east-1 state-tool update/state
   - name: build-workflow-assets
     language: bash
     standalone: true

changelog.md

@@ -6,6 +6,35 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.48.2
+
+### Added
+
+- `state publish --build` now reads `[project].dependencies` from `pyproject.toml` and publishes them as runtime
+  dependencies of the encrypted private ingredient. Version ranges carry over, and OS and Python version markers become
+  dependency conditions (unsupported markers are skipped with a notice).
+- Added `state export ingredient-meta <namespace>/<name>[@version]`, which writes an existing ingredient's meta file for
+  use with `state publish --edit --meta`.
+
+### Changed
+
+- Installing runtimes on Windows is significantly faster: link paths are resolved once per tree instead of once per
+  file, and artifacts are linked concurrently.
+- A `--meta` file's name, version, and description now feed the built wheel (flags take precedence over the meta file,
+  which takes precedence over `pyproject.toml`).
+
+### Fixed
+
+- `state publish --edit` no longer overwrites the meta file's dependencies and authors with the previous revision's,
+  keeps inherited dependency types and conditions, and rejects author or description changes on an existing version
+  up front.
+- `state publish --edit --meta` with an exported meta file now edits the version named in the file rather than the
+  latest version.
+
+### Security
+
+- Updated `github.com/klauspost/compress` to v1.18.7 to remediate CVE-2026-63209 (GHSA-259r-337f-4rfw).
+
 ## 0.48.1
 
 ### Added

cmd/state/internal/cmdtree/cmdtree.go

@@ -55,6 +55,7 @@ func New(prime *primer.Values, args ...string) *CmdTree {
 		newExportLogCommand(prime),
 		newExportRuntimeCommand(prime),
 		newExportBuildPlanCommand(prime),
+		newExportIngredientMetaCommand(prime),
 		deptree,
 	)
 

cmd/state/internal/cmdtree/export.go

@@ -370,3 +370,27 @@ func newExportDepTreeIngredientsCommand(prime *primer.Values) *captain.Command {
 	cmd.SetUnstable(true)
 	return cmd
 }
+
+func newExportIngredientMetaCommand(prime *primer.Values) *captain.Command {
+	runner := export.NewIngredientMeta(prime)
+	params := &export.IngredientMetaParams{}
+
+	return captain.NewCommand(
+		"ingredient-meta",
+		locale.Tl("export_ingredient_meta_title", "Exporting Ingredient Meta File"),
+		locale.Tl("export_ingredient_meta_description", "Export the meta file of a published ingredient, to modify and pass to '[ACTIONABLE]state publish --edit --meta[/RESET]'"),
+		prime,
+		[]*captain.Flag{},
+		[]*captain.Argument{
+			{
+				Name:        "namespace/name[@version]",
+				Description: locale.Tl("export_ingredient_meta_arg_description", "The ingredient to export, e.g. private/<org>/python/mypkg@1.0. Defaults to the latest version."),
+				Value:       &params.Ingredient,
+				Required:    true,
+			},
+		},
+		func(_ *captain.Command, _ []string) error {
+			return runner.Run(params)
+		},
+	)
+}

go.mod

@@ -113,7 +113,7 @@ require (
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/kr/pty v1.1.8 // indirect

go.sum

@@ -478,8 +478,8 @@ github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQL
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.9.5/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=

internal/python/wheel/distinfo.go

@@ -26,6 +26,9 @@ func buildMetadata(meta Metadata) []byte {
 	if meta.Summary != "" {
 		b.WriteString("Summary: " + meta.Summary + "\n")
 	}
+	for _, req := range meta.Requires {
+		b.WriteString("Requires-Dist: " + req + "\n")
+	}
 	return b.Bytes()
 }
 

internal/python/wheel/metadata.go

@@ -12,17 +12,19 @@ import (
 
 // ResolveMetadata reads srcDir's pyproject.toml [project] table and applies the
 // non-empty fields of override on top, producing the metadata to pack with. It
-// errors when neither source supplies a name or version.
+// errors when neither source supplies a name or version. Requires always comes
+// from pyproject.toml's dependencies.
 func ResolveMetadata(srcDir string, override Metadata) (*Metadata, error) {
 	proj, err := readPyProject(filepath.Join(srcDir, "pyproject.toml"))
 	if err != nil {
 		return nil, err
 	}
 
 	meta := Metadata{
-		Name:    firstNonEmpty(override.Name, proj.Name),
-		Version: firstNonEmpty(override.Version, proj.Version),
-		Summary: firstNonEmpty(override.Summary, proj.Description),
+		Name:     firstNonEmpty(override.Name, proj.Name),
+		Version:  firstNonEmpty(override.Version, proj.Version),
+		Summary:  firstNonEmpty(override.Summary, proj.Description),
+		Requires: proj.Dependencies,
 	}
 	if meta.Name == "" || meta.Version == "" {
 		return nil, ErrMissingMetadata
@@ -31,9 +33,10 @@ func ResolveMetadata(srcDir string, override Metadata) (*Metadata, error) {
 }
 
 type pyProject struct {
-	Name        string
-	Version     string
-	Description string
+	Name         string
+	Version      string
+	Description  string
+	Dependencies []string
 }
 
 // readPyProject reads the [project] table from a pyproject.toml. A missing file
@@ -49,18 +52,20 @@ func readPyProject(path string) (pyProject, error) {
 
 	var parsed struct {
 		Project struct {
-			Name        string `toml:"name"`
-			Version     string `toml:"version"`
-			Description string `toml:"description"`
+			Name         string   `toml:"name"`
+			Version      string   `toml:"version"`
+			Description  string   `toml:"description"`
+			Dependencies []string `toml:"dependencies"`
 		} `toml:"project"`
 	}
 	if err := toml.Unmarshal(data, &parsed); err != nil {
 		return pyProject{}, errs.Wrap(err, "could not parse pyproject.toml")
 	}
 	return pyProject{
-		Name:        parsed.Project.Name,
-		Version:     parsed.Project.Version,
-		Description: parsed.Project.Description,
+		Name:         parsed.Project.Name,
+		Version:      parsed.Project.Version,
+		Description:  parsed.Project.Description,
+		Dependencies: parsed.Project.Dependencies,
 	}, nil
 }
 

internal/python/wheel/metadata_test.go

@@ -27,6 +27,18 @@ func TestResolveMetadata(t *testing.T) {
 		}
 	})
 
+	t.Run("pyproject dependencies become Requires", func(t *testing.T) {
+		dir := t.TempDir()
+		writePyproject(t, dir, "[project]\nname = \"proj\"\nversion = \"3.1\"\ndependencies = [\"requests>=2\", \"click\"]\n")
+		res, err := ResolveMetadata(dir, Metadata{Name: "override"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(res.Requires) != 2 || res.Requires[0] != "requests>=2" || res.Requires[1] != "click" {
+			t.Errorf("Requires = %q", res.Requires)
+		}
+	})
+
 	t.Run("caller overrides pyproject", func(t *testing.T) {
 		dir := t.TempDir()
 		writePyproject(t, dir, "[project]\nname = \"proj\"\nversion = \"3.1\"\n")

internal/python/wheel/wheel.go

@@ -40,6 +40,8 @@ type Metadata struct {
 	Name    string
 	Version string
 	Summary string
+	// Requires holds PEP 508 requirement strings, recorded as Requires-Dist.
+	Requires []string
 }
 
 // sourceFile is one file destined for the wheel, identified by its slash path

internal/python/wheel/wheel_test.go

@@ -68,7 +68,7 @@ func TestPackProducesValidWheel(t *testing.T) {
 	})
 
 	out := t.TempDir()
-	wheelPath, err := Pack(src, Metadata{Name: "My.Pkg-Name", Version: "1.0", Summary: "a pkg"}, out)
+	wheelPath, err := Pack(src, Metadata{Name: "My.Pkg-Name", Version: "1.0", Summary: "a pkg", Requires: []string{"requests>=2"}}, out)
 	if err != nil {
 		t.Fatalf("Pack: %v", err)
 	}
@@ -94,7 +94,7 @@ func TestPackProducesValidWheel(t *testing.T) {
 
 	// METADATA / WHEEL contents.
 	metaFile := string(entries[di+"/METADATA"])
-	for _, want := range []string{"Metadata-Version: 2.1", "Name: My.Pkg-Name", "Version: 1.0", "Summary: a pkg"} {
+	for _, want := range []string{"Metadata-Version: 2.1", "Name: My.Pkg-Name", "Version: 1.0", "Summary: a pkg", "Requires-Dist: requests>=2"} {
 		if !bytes.Contains([]byte(metaFile), []byte(want)) {
 			t.Errorf("METADATA missing %q; got:\n%s", want, metaFile)
 		}

internal/runbits/reqop_runbit/update.go

@@ -75,6 +75,12 @@ func UpdateAndReload(prime primeable, script *buildscript.BuildScript, oldCommit
 		if err := script.SetDynamic(false); err != nil {
 			return errs.Wrap(err, "Setting dynamic failed")
 		}
+		// StageCommitAndPoll needs to be called with atTime=now, not the previous script's atTime.
+		latest, err := model.FetchLatestRevisionTimeStamp(prime.Auth())
+		if err != nil {
+			return errs.Wrap(err, "Failed to fetch latest timestamp")
+		}
+		script.SetAtTime(latest, true)
 	}
 
 	commitParams := buildplanner.StageCommitParams{

internal/runners/export/ingredientmeta.go

@@ -0,0 +1,40 @@
+package export
+
+import (
+	"github.com/ActiveState/cli/internal/captain"
+	"github.com/ActiveState/cli/internal/errs"
+	"github.com/ActiveState/cli/internal/locale"
+	"github.com/ActiveState/cli/internal/runners/publish"
+)
+
+type IngredientMetaParams struct {
+	Ingredient captain.PackageValueNSRequired
+}
+
+type IngredientMeta struct {
+	prime primeable
+}
+
+func NewIngredientMeta(p primeable) *IngredientMeta {
+	return &IngredientMeta{p}
+}
+
+func (i *IngredientMeta) Run(params *IngredientMetaParams) error {
+	auth := i.prime.Auth()
+	if !auth.Authenticated() {
+		return locale.NewInputError("err_auth_required")
+	}
+
+	meta, err := publish.FetchMeta(params.Ingredient.Namespace, params.Ingredient.Name, params.Ingredient.Version, auth)
+	if err != nil {
+		return errs.Wrap(err, "Could not fetch ingredient meta data")
+	}
+
+	b, err := meta.MarshalYaml(false)
+	if err != nil {
+		return errs.Wrap(err, "Could not marshal ingredient meta data")
+	}
+
+	i.prime.Output().Print(string(b))
+	return nil
+}

internal/runners/install/install.go

@@ -3,7 +3,6 @@ package install
 import (
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
@@ -269,8 +268,6 @@ func (i *Install) resolveRequirements(packages captain.PackagesValue, ts time.Ti
 	return reqs, nil
 }
 
-var versionRe = regexp.MustCompile(`^\d(\.\d+)*$`)
-
 func resolveVersion(req *requirement) error {
 	version := req.Requested.Version
 
@@ -283,7 +280,7 @@ func resolveVersion(req *requirement) error {
 	// Verify that the version provided can be resolved
 	// Note: if the requirement does not have an ingredient, it is being dynamically imported, so
 	// we cannot resolve its versions yet.
-	if versionRe.MatchString(version) && req.Resolved.ingredient != nil {
+	if req.Resolved.ingredient != nil {
 		match := false
 		for _, knownVersion := range req.Resolved.ingredient.Versions {
 			if knownVersion.Version == version {