[Mikola Lysenko (mikolalysenko)]

Problem

hishel 2.0.0 was published to PyPI on 2026-11-05 at 14:10 UTC. Since then the required e2e (ubuntu-latest, e2e_vex_build, poetry/pdm/hatch/pipenv/deno) leg in ci.yml fails on every PR, and through ci-ok that blocks every merge:

• Require sbt resolution evidence before attesting vendored pins #2008: https://github.com/SocketDev/socket-patch/actions/runs/42064562811/job/127376042009
• Skip unsafe Rush subspace locks in the lock inventory #2003: https://github.com/SocketDev/socket-patch/actions/runs/42064167217/job/127375145350

Both PRs fail the same two tests with the same error. The other suites in the leg (poetry, hatch, pipenv, deno) pass:

test pdm::pdm_vendored_install_then_manifest_less_vex ... FAILED
test pdm::pdm_hosted_install_then_manifest_less_vex ... FAILED
SOCKET_PATCH_PDM_E2E_REQUIRED is set but pdm lock (PyPI) failed: exit Some(1)
[AttributeError]: module 'hishel' has no attribute 'SyncSqliteStorage'

Main is green only because nothing has merged since the release. The next merge_group run will fail too. The pdm-compatibility.yml cells for 2.26.9+ and the nightly / extended pdm legs on recent releases have the same exposure.

Root cause

PDM 2.26.9+ declare an unbounded hishel[httpx]>=1.0.0 (2.29.6 declares >=1.4.0). hishel 2.0 dropped SyncSqliteStorage, which PDM imports at startup. This is the same failure mode as the existing hishel<1 (2.21 to 2.26.0) and unearth<0.19 pins.

Fix

Pin hishel<2 when bootstrapping PDM 2.26.1+, in both crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs and scripts/backtest-pdm.py (the two pins_for copies). For 2.26.1 to 2.26.8, which already bound <1, the pin changes nothing. No test is removed or skipped.

Proof

• Reproduced locally: pip install pdm==2.29.2 'unearth<0.19' resolves hishel 2.0.0, and pdm lock fails with the CI error. Adding 'hishel<2' resolves 1.4.0 and pdm lock succeeds.
• SOCKET_PATCH_PDM_E2E_REQUIRED=1 SOCKET_PATCH_PDM_E2E_VERSION=2.29.2 cargo test -p socket-patch-cli --test e2e_vex_build -- pdm:: --ignored gives 2 passed, and the bootstrapped venv has hishel-1.4.0.
• backtest-pdm.py pins_for: 2.20.1 is unchanged, 2.25.9 keeps hishel<1, and 2.26.1 / 2.29.2 add hishel<2.
• rustfmt --check on the touched file is clean.

https://claude.ai/code/session_011f9aeNshqCtBWV4tqKmmZ6

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review (burn-down agent).

• Head: 6c615de428123b7cebeddafc0c372e81dcdf4690
• CI: 50/50 checks green.
• Bugbot: reviewed this head, no issues found.
• Mergeable, no CHANGELOG.md change.
• Slack announcement not sent this run (no Slack send tool available); the next run will retry.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief (for the human approver)

What it does: hishel 2.0 (released today) removed SyncSqliteStorage, and PDM 2.26.9+ declare an unbounded hishel>=1, so the pdm e2e_vex_build job fails on every PR (it is the red check on #2022, #2017, #2016, #2014, #2011, #2008, #2003). This pins hishel<2 for PDM >= 2.26.1 in the e2e harness and the backtest script, alongside the existing hishel<1 / unearth<0.19 pins. Test-harness only; no product code changes.

Risk: low. Two pin additions in test tooling; no effect on the shipped CLI. For 2.26.1-2.26.8 the pin is a no-op (they already bound <1).

Look here

• pdm.rs:139-147: the new else if t >= (2, 26, 1) branch
• backtest-pdm.py:207-212: the same rule in the backtest script (elif binds to the hishel<1 if, so the ranges are disjoint)

Verified

• Read the full diff (2 files, +14). Branch ranges in Rust and Python match and don't overlap.
• python3 -m py_compile scripts/backtest-pdm.py passes.
• CI on this head: 50/50 (31 success, 19 path-skipped); the pdm e2e_vex_build job ran and passed. Bugbot: no findings. CHANGELOG.md untouched.

Changes I made: none.

Open questions: none blocking. (Nit: required_pins in the backtest doesn't list hishel, so a cached backtest venv built after today wouldn't be detected as broken; same as the existing unearth pin, so out of scope.)

Merging this should turn the other Ready-for-review PRs green after they pick up main. Auto-merge is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code