[Mikola Lysenko (mikolalysenko)]

Problem

pins_for in crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs (and its twin in scripts/backtest-pdm.py) adds unearth<0.19 for every pdm 2.x release and hishel<2 for every release from 2.26.1. Upstream pdm has since moved past both:

pdm	declares	pin we add	result
2.29.2, 2.29.3	unearth>=0.17.5, hishel[httpx]>=1.0.0	both	ok (needed)
2.29.4 – 2.29.6	unearth>=0.19, hishel[httpx2]>=1.4.0	both	ResolutionImpossible (unearth)
2.29.7 (2026-11-06)	unearth>=0.19, hishel[httpx2]>=2.0	both	ResolutionImpossible (unearth and hishel)

So the pdm e2e cases fail before pdm even runs for any current release. CI is green today only because the matrix rows still run pdm 2.29.2 (ci.yml lines 1428, 2201). The next bump of the latest-pdm row, or a backtest of a current release, goes red. This is the same class of break as #2028 (hishel 2.0, which turned e2e_vex_build red on every PR) and #1738 (unearth 0.19): floating deps behind pdm. This PR stops the fixes for those breaks from causing the next one.

Fix

Apply each pin only to the releases that declare the unbounded requirement:

• unearth<0.19 only for pdm < 2.29.4
• hishel<2 only for 2.26.1 ≤ pdm < 2.29.7

The same bounds go into scripts/backtest-pdm.py. Nothing changes for the versions CI runs today (1.4.5, 1.15.5, 2.7.4, 2.8.2, 2.25.9, 2.29.2).

Proof

Real e2e_vex_build pdm cases (SOCKET_PATCH_PDM_E2E_REQUIRED=1 cargo test -p socket-patch-cli --test e2e_vex_build -- pdm:: --ignored), fresh tool caches:

pdm	origin/main	this branch
2.29.2 (matrix)	–	2 passed
2.29.4	2 failed (pip ResolutionImpossible)	2 passed
2.29.7	2 failed (pip ResolutionImpossible)	2 passed

Python pin table after the change: 2.25.9 → hishel<1, unearth<0.19; 2.29.2/2.29.3 → hishel<2, unearth<0.19; 2.29.4/2.29.6 → hishel<2; 2.29.7+ → none.

rustfmt --check on the touched file is clean. cargo clippy -p socket-patch-cli --test e2e_vex_build -- -D warnings reports one pre-existing needless_borrows_for_generic_args error in poetry.rs:473. This PR doesn't touch that file, and CI's clippy configuration doesn't flag it.

Where tests run

No test is added, removed or moved. Only the pdm bootstrap pins change.

Context (CI janitor run 2026-11-06 21:40 UTC)

The merge queue is empty and healthy, and main push and merge_group runs are green. The two nightly failures (gem CRLF source block on bundler 1.17/2.1, and pdm hishel) were fixed by #1999 and #2028 after last night's run. 15 open PRs are still red on the pdm leg because their heads predate #2028 and need origin/main merged in.

https://claude.ai/code/session_011f9aeQMSUtsXXCdCmmVd9T

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f0cac3e. Configure here.}