[cookabc]

Summary

Fixes four high-priority issues from the review of main. Upgrades now change only the lower bound or pin, pyproject edits hit the named package, unversioned and URL dependencies no longer offer an Update lens, and vsce package succeeds while engines.vscode stays ^1.85.0.

1. Multi-constraint specifiers were rewritten as a single version

Problem. The requirements regex treated commas as part of the version token, and the replacement was always operator + newVersion for the first operator it saw.

• requests>=2.0,<3.0 became requests>=2.32.3 (upper bound dropped).
• foo!=1.5,>=1.0 became foo!=1.9 (the exclusion was overwritten and the lower bound was lost).
• django~=4.2 became ~=4.2.16, which PEP 440 narrows from <5 to <4.3.

Fix. planLineUpdate / buildVersionReplacement in src/utils/dependencyUtils.ts rewrite only bumpable constraints (>=, >, ==, ===, ~=, ^). <, <=, and != are left in place. > is written as >= at the resolved version so that version is actually allowed. ~= is truncated to the original release precision, and a no-op (~=4.2 already covers 4.2.16) is not offered as an update. The single-package command and Update All both go through this planner, and risk analysis uses the floor/pin (1.0 in !=2.0,>=1.0) rather than the exclusion.

Tests (src/test/unit/upgradeCorrectness.test.ts):

• bumps the lower bound and keeps the upper bound
• bumps the lower bound and keeps exclusions
• does not treat an exclusion as the current version for risk analysis
• preserves compatible-release precision
• turns an exclusive lower bound into an inclusive one at the new version
• rewrites a TOML exclusion without inverting it

2. A shared name prefix edited the wrong pyproject dependency

Problem. parsePyProjectDocument set startColumn with line.indexOf(packageName). On ["pytest-cov>=4.0", "pytest>=7.0"], pytest matched the start of pytest-cov, so the upgrade rewrote pytest-cov.

Fix. findDependencySpan in src/core/pyprojectParser.ts locates the package inside its own quoted requirement (with a name-boundary fallback). The column span stops at that requirement, so a later shorter name is not inside the longer one's range.

Tests:

• updates pytest and not pytest-cov when they share a line
• updates pytest-cov when the shorter name comes first

3. Unversioned and URL dependencies showed a Major Update lens

Problem. A requirement with no version still compared an empty current version (0.0.0) to the latest release and offered a Major update. Confirming requests ; python_version >= "3.8" rewrote the marker to python_version >=2.32.3 because version extraction searched past ;. Bare requests showed the warning and then did nothing. pkg @ https://... got the same useless Update lens.

Fix. Version search stops at ; and # (and at the closing quote of the current TOML string) and ignores a PEP 508 @ reference. classifyVersionLens returns hidden when there is no version constraint, and provideCodeLenses does not create a version lens for those dependencies (the PyPI link remains). The update command returns before the Major dialog when there is nothing safe to change.

Tests:

• does not rewrite a marker when the requirement has no version
• does not rewrite a bare package name
• does not rewrite a PEP 508 direct reference
• keeps a versioned requirement's environment marker
• offers an update for a real lower bound inside a marker
• does not create an update lens for bare, marker-only, or URL requirements
• does not create an update lens for unversioned pyproject dependencies

4. vsce package failed on the engines / types mismatch

Problem. @types/vscode was ^1.140.0 while engines.vscode is ^1.85.0. npx @vscode/vsce package rejects a types minor newer than the engine, so publish.yml could not package.

Fix. @types/vscode is pinned to 1.85.0 (the engine floor). engines.vscode stays ^1.85.0. AGENTS.md now records that pin. CI runs npx @vscode/vsce package after the tests.

Verification

• npm run compile
• npm test (132 passing)
• npm run lint
• npx @vscode/vsce package