From fec0f55739f5ed6b7607706f1c04088eef5781cd Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Wed, 5 Aug 2026 23:39:01 +0900
Subject: [PATCH 01/16] wip

---
 examples/BUILD.bazel                      |  1 +
 examples/bzlmod/requirements_lock_3_9.txt | 24 +++++------
 python/uv/private/lock.bzl                | 52 ++++++++++++++++++++---
 script.sh                                 | 18 ++++++++
 4 files changed, 77 insertions(+), 18 deletions(-)
 create mode 100755 script.sh

diff --git a/examples/BUILD.bazel b/examples/BUILD.bazel
index a08e5e64ae..ffb2e50049 100644
--- a/examples/BUILD.bazel
+++ b/examples/BUILD.bazel
@@ -21,6 +21,7 @@ lock(
     name = "bzlmod_requirements_3_9",
     srcs = ["bzlmod/requirements.in"],
     out = "bzlmod/requirements_lock_3_9.txt",
+    directory = "examples/bzlmod",
     args = [
         "--emit-index-url",
         "--universal",
diff --git a/examples/bzlmod/requirements_lock_3_9.txt b/examples/bzlmod/requirements_lock_3_9.txt
index 8a6d41441a..938f6ad7b6 100644
--- a/examples/bzlmod/requirements_lock_3_9.txt
+++ b/examples/bzlmod/requirements_lock_3_9.txt
@@ -27,7 +27,7 @@ colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
-    #   -r examples/bzlmod/requirements.in
+    #   -r requirements.in
     #   pylint
     #   sphinx
 dill==0.3.6 \
@@ -183,17 +183,17 @@ pylint==2.15.9 \
     --hash=sha256:18783cca3cfee5b83c6c5d10b3cdb66c6594520ffae61890858fe8d932e1c6b4 \
     --hash=sha256:349c8cd36aede4d50a0754a8c0218b43323d13d5d88f4b2952ddfe3e169681eb
     # via
-    #   -r examples/bzlmod/requirements.in
+    #   -r requirements.in
     #   pylint-print
 pylint-print==1.0.1 \
     --hash=sha256:30aa207e9718ebf4ceb47fb87012092e6d8743aab932aa07aa14a73e750ad3d0 \
     --hash=sha256:a2b2599e7887b93e551db2624c523c1e6e9e58c3be8416cd98d41e4427e2669b
-    # via -r examples/bzlmod/requirements.in
+    # via -r requirements.in
 python-dateutil==2.8.2 \
     --hash=sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86 \
     --hash=sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9
     # via
-    #   -r examples/bzlmod/requirements.in
+    #   -r requirements.in
     #   s3cmd
 python-magic==0.4.27 \
     --hash=sha256:c1ba14b08e4a5f5c31a302b7721239695b2f0f058d125bd5ce1ee36b9d9d3c3b \
@@ -256,12 +256,12 @@ requests==2.25.1 \
     --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804 \
     --hash=sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e
     # via
-    #   -r examples/bzlmod/requirements.in
+    #   -r requirements.in
     #   sphinx
 s3cmd==2.1.0 \
     --hash=sha256:49cd23d516b17974b22b611a95ce4d93fe326feaa07320bd1d234fed68cbccfa \
     --hash=sha256:966b0a494a916fc3b4324de38f089c86c70ee90e8e1cae6d59102103a4c0cc03
-    # via -r examples/bzlmod/requirements.in
+    # via -r requirements.in
 setuptools==78.1.1 \
     --hash=sha256:c3a9c4211ff4c309edb8b8c4f1cbfa7ae324c4ba9f91ff254e3d305b9fd54561 \
     --hash=sha256:fcc17fd9cd898242f6b4adfaca46137a9edef687f43e6f78469692a5e70d851d
@@ -280,7 +280,7 @@ sphinx==7.2.6 \
     --hash=sha256:1e09160a40b956dc623c910118fa636da93bd3ca0b9876a7b3df90f07d691560 \
     --hash=sha256:9a5160e1ea90688d5963ba09a2dcd8bdd526620edbb65c328728f1b2228d5ab5
     # via
-    #   -r examples/bzlmod/requirements.in
+    #   -r requirements.in
     #   sphinxcontrib-applehelp
     #   sphinxcontrib-devhelp
     #   sphinxcontrib-htmlhelp
@@ -310,12 +310,12 @@ sphinxcontrib-serializinghtml==1.1.9 \
     --hash=sha256:0c64ff898339e1fac29abd2bf5f11078f3ec413cfe9c046d3120d7ca65530b54 \
     --hash=sha256:9b36e503703ff04f20e9675771df105e58aa029cfcbc23b8ed716019b7416ae1
     # via
-    #   -r examples/bzlmod/requirements.in
+    #   -r requirements.in
     #   sphinx
 tabulate==0.9.0 \
     --hash=sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c \
     --hash=sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f
-    # via -r examples/bzlmod/requirements.in
+    # via -r requirements.in
 tomli==2.0.1 ; python_full_version < '3.11' \
     --hash=sha256:939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc \
     --hash=sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f
@@ -405,11 +405,11 @@ websockets==11.0.3 \
     --hash=sha256:f61bdb1df43dc9c131791fbc2355535f9024b9a04398d3bd0684fc16ab07df74 \
     --hash=sha256:fb06eea71a00a7af0ae6aefbb932fb8a7df3cb390cc217d51a9ad7343de1b8d0 \
     --hash=sha256:ffd7dcaf744f25f82190856bc26ed81721508fc5cbf2a330751e135ff1283564
-    # via -r examples/bzlmod/requirements.in
+    # via -r requirements.in
 wheel==0.40.0 \
     --hash=sha256:cd1196f3faee2b31968d626e1731c94f99cbdb67cf5a46e4f5656cbee7738873 \
     --hash=sha256:d236b20e7cb522daf2390fa84c55eea81c5c30190f90f29ae2ca1ad8355bf247
-    # via -r examples/bzlmod/requirements.in
+    # via -r requirements.in
 wrapt==1.14.1 \
     --hash=sha256:00b6d4ea20a906c0ca56d84f93065b398ab74b927a7a3dbd470f6fc503f95dc3 \
     --hash=sha256:01c205616a89d09827986bc4e859bcabd64f5a0662a7fe95e0d359424e0e071b \
@@ -479,7 +479,7 @@ wrapt==1.14.1 \
 yamllint==1.28.0 \
     --hash=sha256:89bb5b5ac33b1ade059743cf227de73daa34d5e5a474b06a5e17fc16583b0cf2 \
     --hash=sha256:9e3d8ddd16d0583214c5fdffe806c9344086721f107435f68bad990e5a88826b
-    # via -r examples/bzlmod/requirements.in
+    # via -r requirements.in
 zipp==3.20.0 ; python_full_version < '3.10' \
     --hash=sha256:0145e43d89664cfe1a2e533adc75adafed82fe2da404b4bbb6b026c0157bdb31 \
     --hash=sha256:58da6168be89f0be59beb194da1250516fdaa062ccebd30127ac65d30045e10d
diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 695591e924..f1bb9ca8cf 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -71,6 +71,30 @@ def _args(ctx):
         add_all = _add_all,
     )
 
+def _reroot(x, directory):
+    if not directory:
+        return x
+
+    if hasattr(x, "short_path"):
+        x = x.short_path
+
+    return x[len(directory)+1:] or "."
+
+def _reroot_all(xs, directory):
+    return [
+        _reroot(x, directory)
+        for x in xs
+    ]
+
+def _up(x, directory):
+    if not directory:
+        return x
+
+    return "{}/{}".format(
+        "/".join([".."] * (len(directory.split("/"))+0)),
+        getattr(x, "short_path", x),
+    )
+
 def _common_lock(ctx, locker):
     fname = "{}.out".format(ctx.label.name)
 
@@ -117,11 +141,12 @@ def _common_lock(ctx, locker):
                     # select the shortest match
                     project = src.dirname
 
+    directory = getattr(ctx.attr, "directory", None)
     if project == None:
         project = ctx.label.package
 
     if project:
-        args.add_all([project], before_each = "--project")
+        args.add_all([_reroot(project, directory)], before_each = "--project")
 
     args.add_all(ctx.attr.args)
 
@@ -129,7 +154,7 @@ def _common_lock(ctx, locker):
     runtime = exec_tools.exec_interpreter[platform_common.ToolchainInfo].py3_runtime
     python = runtime.interpreter or runtime.interpreter_path
     python_files = runtime.files or depset()
-    args.add("--python", python)
+    args.add("--python", _up(python, directory))
 
     # These arguments does not change behaviour, but it reduces the output from
     # the command, which is especially verbose in stderr.
@@ -252,14 +277,20 @@ def _pip_compile_impl(ctx):
         if not ctx.attr.strip_extras:
             args.add("--no-strip-extras")
 
-        args.add_all(ctx.files.build_constraints, before_each = "--build-constraints")
-        args.add_all(ctx.files.constraints, before_each = "--constraints")
+        directory = ctx.attr.directory
+
+        if directory:
+            args.add_all([directory], before_each = "--directory")
+
+        # TODO @aignas 2026-08-04: fix the --directory handling
+        args.add_all(_reroot_all(ctx.files.build_constraints, directory), before_each = "--build-constraints")
+        args.add_all(_reroot_all(ctx.files.constraints, directory), before_each = "--constraints")
 
-        args.run_shell.add("--output-file", output)
+        args.run_shell.add("--output-file", _reroot(output, directory))
         mnemonic = "PyRequirementsLockUv"
         progress_message = "Creating a requirements.txt with uv: %{label}"
 
-        args.add_all(ctx.files.srcs)
+        args.add_all(_reroot_all(ctx.files.srcs, directory))
         srcs = ctx.files.srcs + ctx.files.build_constraints + ctx.files.constraints
 
         return srcs, None, mnemonic, progress_message
@@ -342,6 +373,12 @@ Added the {attr}`project` to configure the project setting if autodetection fail
             allow_files = True,
             doc = "Public, see the docs in the macro.",
         ),
+        "directory": attr.string(
+            doc = """\
+Sets the --directory flag if provided. Will fail if at least one of the files
+does not start with the given prefix of the directory.
+""",
+        ),
         "generate_hashes": attr.bool(
             doc = "Public, see the docs in the macro.",
             default = True,
@@ -535,6 +572,7 @@ def lock(
         env = None,
         generate_hashes = True,
         python_version = None,
+        directory = None,
         project = None,
         strip_extras = False,
         **kwargs):
@@ -636,6 +674,8 @@ def lock(
         lock_target_kwargs["build_constraints"] = build_constraints
     if constraints:
         lock_target_kwargs["constraints"] = constraints
+    if directory:
+        lock_target_kwargs["directory"] = directory
 
     if out.endswith(".lock"):
         _lock(name = name, **lock_target_kwargs)
diff --git a/script.sh b/script.sh
new file mode 100755
index 0000000000..9163fde5cf
--- /dev/null
+++ b/script.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+args=(
+    uv
+    pip
+    compile
+    "--generate-hashes"
+    "--no-strip-extras"
+)
+
+"${args[@]}" \
+    --directory examples/bzlmod \
+    requirements.in \
+    --python-version=3.9 \
+    --output-file requirements_lock_3_9.txt \
+    --universal \
+    --custom-compile-command="bazel run //examples:bzlmod_requirements_3_9.update" \
+    --emit-index-url

From dfe095ed7831b26165e978d796a6761608273c15 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Sun, 9 Aug 2026 23:51:16 +0900
Subject: [PATCH 02/16] get the directory attr work

---
 dev/BUILD.bazel                              |  1 +
 dev/requirements.txt                         | 54 ++++++++++----------
 python/uv/private/lock.bzl                   | 32 ++++++++----
 python/uv/private/template/uv_lock.sh        |  2 +-
 python/uv/private/template/uv_pip_compile.sh | 13 +++++
 5 files changed, 65 insertions(+), 37 deletions(-)

diff --git a/dev/BUILD.bazel b/dev/BUILD.bazel
index 91b2a9f566..423d4c84d3 100644
--- a/dev/BUILD.bazel
+++ b/dev/BUILD.bazel
@@ -12,6 +12,7 @@ lock(
         "--universal",
         "--upgrade",
     ],
+    directory = "dev",
     # NOTE @aignas 2025-08-17: here we select the lowest actively supported version so that the
     # requirements file is generated to be compatible with Python version 3.9 or greater.
     python_version = "3.9",
diff --git a/dev/requirements.txt b/dev/requirements.txt
index 943fce2dcf..d0a8984d51 100644
--- a/dev/requirements.txt
+++ b/dev/requirements.txt
@@ -5,11 +5,11 @@
 absl-py==2.3.1 ; python_full_version < '3.10' \
     --hash=sha256:a97820526f7fbfd2ec1bce83f3f25e3a14840dac0d8e02a0b71cd75db3f77fc9 \
     --hash=sha256:eeecf07f0c2a93ace0772c92e596ace6d3d3996c042b2128459aaae2a76de11d
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 absl-py==2.5.0 ; python_full_version >= '3.10' \
     --hash=sha256:0c996f25c0490700fadabe6351630f6111534fa0ae252cc6d2014ea3b141135f \
     --hash=sha256:0f17b89f2a4eaaedc4f28c622998aa690564b3012a396a4ffad0821007fe03ba
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 alabaster==0.7.16 ; python_full_version < '3.10' \
     --hash=sha256:75a8b99c28a5dad50dd7f8ccdd447a121ddb3892da9e53d1ca5cca3106d58d65 \
     --hash=sha256:b46733c07dce03ae4e150330b975c75737fa60f0a7c591b6c8bf4928a28e2c92
@@ -187,7 +187,7 @@ jinja2==3.1.6 \
 macholib==1.16.4 \
     --hash=sha256:da1a3fa8266e30f0ce7e97c6a54eefaae8edd1e5f86f3eb8b95457cae90265ea \
     --hash=sha256:f408c93ab2e995cd2c46e34fe328b130404be143469e41bc366c807448979362
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 markdown-it-py==3.0.0 ; python_full_version < '3.11' \
     --hash=sha256:355216845c60bd96232cd8d8c40e8f9765cc86f46880e43a8fd22dc1a1a8cab1 \
     --hash=sha256:e3f60a94fa066dc52ec76661e37c851cb232d92f9886b15cb560aaada2df8feb
@@ -291,7 +291,7 @@ markupsafe==3.0.3 \
     --hash=sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a \
     --hash=sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   jinja2
 mdit-py-plugins==0.4.2 ; python_full_version < '3.10' \
     --hash=sha256:0c673c3f889399a33b95e88d2f0d111b4447bdfea7f237dab2d488f459835636 \
@@ -308,18 +308,18 @@ mdurl==0.1.2 \
 myst-parser==3.0.1 ; python_full_version < '3.10' \
     --hash=sha256:6457aaa33a5d474aca678b8ead9b3dc298e89c68e67012e73146ea6fd54babf1 \
     --hash=sha256:88f0cb406cb363b077d176b51c476f62d60604d68a8dcdf4832e080441301a87
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 myst-parser==4.0.1 ; python_full_version == '3.10.*' \
     --hash=sha256:5cfea715e4f3574138aecbf7d54132296bfd72bb614d31168f48c477a830a7c4 \
     --hash=sha256:9134e88959ec3b5780aedf8a99680ea242869d012e8821db3126d427edc9c95d
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 myst-parser==5.1.0 ; python_full_version >= '3.11' \
     --hash=sha256:9c91c52b3cdb4d94a6506e4fab4e2f296c7623a0da0dcbe6de1565c3dad67a8a \
     --hash=sha256:ab69322dc6719dcc7f296479dbb70181b66df6ed315064f92dbc85c0e1bf2f02
-    # via rules-python-dev (dev/pyproject.toml)
-packaging==26.2 \
-    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \
-    --hash=sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661
+    # via rules-python-dev (pyproject.toml)
+packaging==26.3 \
+    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
+    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
     # via
     #   pytest
     #   readthedocs-sphinx-ext
@@ -327,7 +327,7 @@ packaging==26.2 \
 pefile==2024.8.26 \
     --hash=sha256:3ff6c5d8b43e8c37bb6e6dd5085658d658a7a0bdcd20b6a07b1fcfc1c4e9d632 \
     --hash=sha256:76f8b485dcd3b1bb8166f1128d395fa3d87af26360c2358fb75b80019b957c6f
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pluggy==1.6.0 \
     --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
     --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
@@ -335,11 +335,11 @@ pluggy==1.6.0 \
 pyelftools==0.32 ; python_full_version < '3.10' \
     --hash=sha256:013df952a006db5e138b1edf6d8a68ecc50630adbd0d83a2d41e7f846163d738 \
     --hash=sha256:6de90ee7b8263e740c8715a925382d4099b354f29ac48ea40d840cf7aa14ace5
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pyelftools==0.33 ; python_full_version >= '3.10' \
     --hash=sha256:660d82dcbeb8e83d1702bd97f223f761625da06111c0cc988eac6b8ab0c1b61f \
     --hash=sha256:f215ad5f47d3f1373a21496a6c9e0707c622840d0622f23ff7ce08678b020036
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pygments==2.20.0 \
     --hash=sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f \
     --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
@@ -350,23 +350,23 @@ pytest==8.4.2 ; python_full_version < '3.10' \
     --hash=sha256:86c0d0b93306b961d58d62a4db4879f27fe25513d4b969df351abdddb3c30e01 \
     --hash=sha256:872f880de3fc3a5bdc88a11b39c9710c3497a547cfa9320bc3c5e62fbf272e79
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   pytest-bazel
     #   pytest-mock
 pytest==9.1.1 ; python_full_version >= '3.10' \
     --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \
     --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   pytest-bazel
     #   pytest-mock
 pytest-bazel==0.1.6 \
     --hash=sha256:a29e80e1d67c3db801bdd4d0b6b742f2bfb48cd6841caa33401458e5c4e29c21
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pytest-mock==3.15.1 \
     --hash=sha256:0a25e2eb88fe5168d535041d09a4529a188176ae608a6d249ee65abc0949630d \
     --hash=sha256:1849a238f6f396da19762269de72cb1814ab44416fa73a8686deac10b0d87a0f
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pyyaml==6.0.3 \
     --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
     --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -445,7 +445,7 @@ pyyaml==6.0.3 \
 readthedocs-sphinx-ext==2.2.5 \
     --hash=sha256:ee5fd5b99db9f0c180b2396cbce528aa36671951b9526bb0272dbfce5517bd27 \
     --hash=sha256:f8c56184ea011c972dd45a90122568587cc85b0127bc9cf064d17c68bc809daa
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 requests==2.32.5 ; python_full_version < '3.10' \
     --hash=sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6 \
     --hash=sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf
@@ -470,7 +470,7 @@ sphinx==7.4.7 ; python_full_version < '3.10' \
     --hash=sha256:242f92a7ea7e6c5b406fdc2615413890ba9f699114a9c09192d7dfead2ee9cfe \
     --hash=sha256:c2419e2135d11f1951cd994d6eb18a1835bd8fdd8429f9ca375dc1f3281bd239
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   myst-parser
     #   sphinx-reredirects
     #   sphinx-rtd-theme
@@ -479,7 +479,7 @@ sphinx==8.1.3 ; python_full_version == '3.10.*' \
     --hash=sha256:09719015511837b76bf6e03e42eb7595ac8c2e41eeb9c29c5b755c6b677992a2 \
     --hash=sha256:43c1911eecb0d3e161ad78611bc905d1ad0e523e4ddc202a58a821773dc4c927
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   myst-parser
     #   sphinx-reredirects
     #   sphinx-rtd-theme
@@ -488,7 +488,7 @@ sphinx==9.0.4 ; python_full_version == '3.11.*' \
     --hash=sha256:594ef59d042972abbc581d8baa577404abe4e6c3b04ef61bd7fc2acbd51f3fa3 \
     --hash=sha256:5bebc595a5e943ea248b99c13814c1c5e10b3ece718976824ffa7959ff95fffb
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   myst-parser
     #   sphinx-reredirects
     #   sphinx-rtd-theme
@@ -497,7 +497,7 @@ sphinx==9.1.0 ; python_full_version >= '3.12' \
     --hash=sha256:7741722357dd75f8190766926071fed3bdc211c74dd2d7d4df5404da95930ddb \
     --hash=sha256:c84fdd4e782504495fe4f2c0b3413d6c2bf388589bb352d439b2a3bb99991978
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   myst-parser
     #   sphinx-reredirects
     #   sphinx-rtd-theme
@@ -505,19 +505,19 @@ sphinx==9.1.0 ; python_full_version >= '3.12' \
 sphinx-autodoc2==0.5.0 \
     --hash=sha256:7d76044aa81d6af74447080182b6868c7eb066874edc835e8ddf810735b6565a \
     --hash=sha256:e867013b1512f9d6d7e6f6799f8b537d6884462acd118ef361f3f619a60b5c9e
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 sphinx-reredirects==0.1.6 ; python_full_version < '3.11' \
     --hash=sha256:c491cba545f67be9697508727818d8626626366245ae64456fe29f37e9bbea64 \
     --hash=sha256:efd50c766fbc5bf40cd5148e10c00f2c00d143027de5c5e48beece93cc40eeea
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 sphinx-reredirects==1.1.0 ; python_full_version >= '3.11' \
     --hash=sha256:4b5692273c72cd2d4d917f4c6f87d5919e4d6114a752d4be033f7f5f6310efd9 \
     --hash=sha256:fb9b195335ab14b43f8273287d0c7eeb637ba6c56c66581c11b47202f6718b29
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 sphinx-rtd-theme==3.1.0 \
     --hash=sha256:1785824ae8e6632060490f67cf3a72d404a85d2d9fc26bce3619944de5682b89 \
     --hash=sha256:b44276f2c276e909239a4f6c955aa667aaafeb78597923b1c60babc76db78e4c
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0 \
     --hash=sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1 \
     --hash=sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5
@@ -602,7 +602,7 @@ typing-extensions==4.16.0 \
     --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
     --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   astroid
     #   exceptiongroup
     #   sphinx-autodoc2
diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index f1bb9ca8cf..0ec5d21d9c 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -78,7 +78,7 @@ def _reroot(x, directory):
     if hasattr(x, "short_path"):
         x = x.short_path
 
-    return x[len(directory)+1:] or "."
+    return x[len(directory) + 1:] or "."
 
 def _reroot_all(xs, directory):
     return [
@@ -86,14 +86,16 @@ def _reroot_all(xs, directory):
         for x in xs
     ]
 
-def _up(x, directory):
+def _up(x, directory, short_path = False):
     if not directory:
         return x
 
-    return "{}/{}".format(
-        "/".join([".."] * (len(directory.split("/"))+0)),
-        getattr(x, "short_path", x),
-    )
+    prefix = "/".join([".."] * (len(directory.split("/"))))
+
+    if short_path:
+        return "{}/{}".format(prefix, x.short_path)
+    else:
+        return "{}/{}".format(prefix, x.path)
 
 def _common_lock(ctx, locker):
     fname = "{}.out".format(ctx.label.name)
@@ -126,6 +128,8 @@ def _common_lock(ctx, locker):
         "--no-python-downloads",
         "--no-cache",
     ])
+    rootdir = "{}/{}".format(ctx.label.package, ctx.label.name)
+    workdir = rootdir
 
     project = None
     if ctx.attr.project:
@@ -142,6 +146,9 @@ def _common_lock(ctx, locker):
                     project = src.dirname
 
     directory = getattr(ctx.attr, "directory", None)
+    if directory:
+        workdir = "{}/{}".format(workdir, directory)
+
     if project == None:
         project = ctx.label.package
 
@@ -154,7 +161,10 @@ def _common_lock(ctx, locker):
     runtime = exec_tools.exec_interpreter[platform_common.ToolchainInfo].py3_runtime
     python = runtime.interpreter or runtime.interpreter_path
     python_files = runtime.files or depset()
-    args.add("--python", _up(python, directory))
+
+    # Handle python
+    args.run_shell.add("--python", _up(python, workdir))
+    args.run_info.extend(["--python", _up(python, directory, short_path = True)])
 
     # These arguments does not change behaviour, but it reduces the output from
     # the command, which is especially verbose in stderr.
@@ -220,8 +230,10 @@ def _common_lock(ctx, locker):
     ctx.actions.expand_template(
         template = ctx.files._template[0],
         substitutions = {
+            '"$SRCS"': " ".join([s.path for s in srcs]),
             '"{{args}}"': windows_args,
             "{{out}}": output_path,
+            "{{rootdir}}": rootdir,
             "{{src_out}}": src_out_path,
         },
         output = script,
@@ -278,9 +290,9 @@ def _pip_compile_impl(ctx):
             args.add("--no-strip-extras")
 
         directory = ctx.attr.directory
-
         if directory:
-            args.add_all([directory], before_each = "--directory")
+            args.run_shell.add("--directory={}/{}/{}".format(ctx.label.package, ctx.label.name, directory))
+            args.run_info.append("--directory={}".format(directory))
 
         # TODO @aignas 2026-08-04: fix the --directory handling
         args.add_all(_reroot_all(ctx.files.build_constraints, directory), before_each = "--build-constraints")
@@ -612,6 +624,8 @@ def lock(
             is passed as is and the environment variables are not expanded.
         build_constraints: {type}`list[Label]` The list of build constraints to use.
         constraints: {type}`list[Label]` The list of constraints files to use.
+        directory: {type}`str` The directory into which we should cd when running
+            the command. Only supported for requirements.txt generation.
         generate_hashes: {type}`bool` Generate hashes for all of the
             requirements. Only meaningful for `requirements.txt` style output.
             Defaults to `True`.
diff --git a/python/uv/private/template/uv_lock.sh b/python/uv/private/template/uv_lock.sh
index a6dd6d3c39..2385c0f87a 100755
--- a/python/uv/private/template/uv_lock.sh
+++ b/python/uv/private/template/uv_lock.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -euo pipefail
+set -euxo pipefail
 
 if [[ -n "${BUILD_WORKSPACE_DIRECTORY:-}" ]]; then
     exec "{{args}}" "$@"
diff --git a/python/uv/private/template/uv_pip_compile.sh b/python/uv/private/template/uv_pip_compile.sh
index ba379ed0f9..983e296d48 100755
--- a/python/uv/private/template/uv_pip_compile.sh
+++ b/python/uv/private/template/uv_pip_compile.sh
@@ -12,4 +12,17 @@ readonly out="{{out}}"
 if [[ -f "{{src_out}}" ]]; then
     cp "{{src_out}}" "$out"
 fi
+cp_srcs=(
+    "$SRCS"
+)
+# Copy all of the sources under a new directory, so that `directory` arg is working
+# as expected and we can reroot the sources if needed. This also is a starting point
+# to get the workspaces working properly in the sandbox - with this copying of sources
+# we can remap the paths if needed, but that would require another attribute.
+for src in "${cp_srcs[@]}"; do
+    # First create a dir if it does not exist
+    mkdir -p "$(dirname "{{rootdir}}/$src")"
+    # Then copy the source to the dir
+    cp -v "$src" "{{rootdir}}/$src"
+done
 exec "$@"

From aa1aa747192a98c89641549c01745461d34e93b0 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Mon, 10 Aug 2026 00:03:20 +0900
Subject: [PATCH 03/16] add versionadded

---
 python/uv/private/lock.bzl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 0ec5d21d9c..08aaf0841e 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -626,6 +626,7 @@ def lock(
         constraints: {type}`list[Label]` The list of constraints files to use.
         directory: {type}`str` The directory into which we should cd when running
             the command. Only supported for requirements.txt generation.
+            {versionadded} VERSION_NEXT_MINOR
         generate_hashes: {type}`bool` Generate hashes for all of the
             requirements. Only meaningful for `requirements.txt` style output.
             Defaults to `True`.

From cf92b3a91b947f4b19e2eafc178aab582fd14b09 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Mon, 10 Aug 2026 00:35:06 +0900
Subject: [PATCH 04/16] Add directory support to uv.lock generation

---
 dev/BUILD.bazel                       |  1 +
 python/uv/private/lock.bzl            | 21 ++++++++++-----------
 python/uv/private/template/uv_lock.sh | 18 +++++++++++++++---
 3 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/dev/BUILD.bazel b/dev/BUILD.bazel
index 423d4c84d3..6fc70f3eb5 100644
--- a/dev/BUILD.bazel
+++ b/dev/BUILD.bazel
@@ -24,6 +24,7 @@ lock(
     name = "uv_lock",
     srcs = ["pyproject.toml"],
     out = "uv.lock",
+    directory = "dev",
     python_version = "3.9",
     visibility = ["//:__subpackages__"],
 )
diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 08aaf0841e..8359cbe370 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -145,9 +145,11 @@ def _common_lock(ctx, locker):
                     # select the shortest match
                     project = src.dirname
 
-    directory = getattr(ctx.attr, "directory", None)
+    directory = ctx.attr.directory
     if directory:
         workdir = "{}/{}".format(workdir, directory)
+        args.run_shell.add("--directory={}".format(workdir))
+        args.run_info.append("--directory={}".format(directory))
 
     if project == None:
         project = ctx.label.package
@@ -290,9 +292,6 @@ def _pip_compile_impl(ctx):
             args.add("--no-strip-extras")
 
         directory = ctx.attr.directory
-        if directory:
-            args.run_shell.add("--directory={}/{}/{}".format(ctx.label.package, ctx.label.name, directory))
-            args.run_info.append("--directory={}".format(directory))
 
         # TODO @aignas 2026-08-04: fix the --directory handling
         args.add_all(_reroot_all(ctx.files.build_constraints, directory), before_each = "--build-constraints")
@@ -327,6 +326,12 @@ _common_attrs = {
     "args": attr.string_list(
         doc = "Public, see the docs in the macro.",
     ),
+    "directory": attr.string(
+        doc = """\
+Sets the --directory flag if provided. Will fail if at least one of the files
+does not start with the given prefix of the directory.
+""",
+    ),
     "env": attr.string_dict(
         doc = "Public, see the docs in the macro.",
     ),
@@ -385,12 +390,6 @@ Added the {attr}`project` to configure the project setting if autodetection fail
             allow_files = True,
             doc = "Public, see the docs in the macro.",
         ),
-        "directory": attr.string(
-            doc = """\
-Sets the --directory flag if provided. Will fail if at least one of the files
-does not start with the given prefix of the directory.
-""",
-        ),
         "generate_hashes": attr.bool(
             doc = "Public, see the docs in the macro.",
             default = True,
@@ -625,7 +624,7 @@ def lock(
         build_constraints: {type}`list[Label]` The list of build constraints to use.
         constraints: {type}`list[Label]` The list of constraints files to use.
         directory: {type}`str` The directory into which we should cd when running
-            the command. Only supported for requirements.txt generation.
+            the command.
             {versionadded} VERSION_NEXT_MINOR
         generate_hashes: {type}`bool` Generate hashes for all of the
             requirements. Only meaningful for `requirements.txt` style output.
diff --git a/python/uv/private/template/uv_lock.sh b/python/uv/private/template/uv_lock.sh
index 2385c0f87a..11d6bacdf7 100755
--- a/python/uv/private/template/uv_lock.sh
+++ b/python/uv/private/template/uv_lock.sh
@@ -21,12 +21,24 @@ fi
 # 1. If the current uv.lock does not exist yet
 #    1. Run uv
 #    2. Copy the contents to out.
+
+# Copy all of the sources under a new directory, so that `directory` arg is working
+# as expected and we can reroot the sources if needed. This also is a starting point
+# to get the workspaces working properly in the sandbox - with this copying of sources
+# we can remap the paths if needed, but that would require another attribute.
+for src in "${cp_srcs[@]}"; do
+    # First create a dir if it does not exist
+    mkdir -p "$(dirname "{{rootdir}}/$src")"
+    # Then copy the source to the dir
+    cp -v "$src" "{{rootdir}}/$src"
+done
 readonly out="{{out}}"
 if [[ -f "{{src_out}}" ]]; then
     cp "{{src_out}}" "$out"
-    rm "{{src_out}}"
-    ln -s "$(pwd)"/"$out" "{{src_out}}"
+    mkdir -p "$(dirname "{{rootdir}}/{{src_out}}")"
+    ln -s "$(pwd)"/"$out" "{{rootdir}}/{{src_out}}"
 else
-    ln -s "$(pwd)"/"$out" "{{src_out}}"
+    mkdir -p "$(dirname "{{rootdir}}/{{src_out}}")"
+    ln -s "$(pwd)"/"$out" "{{rootdir}}/{{src_out}}"
 fi
 exec "$@"

From 3a6697f9a6ebe7a8a5088b54329462e5eb6cfc47 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Mon, 10 Aug 2026 00:35:43 +0900
Subject: [PATCH 05/16] wip uv pip compile directory support for windows

---
 python/uv/private/template/uv_pip_compile.bat | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/python/uv/private/template/uv_pip_compile.bat b/python/uv/private/template/uv_pip_compile.bat
index 2ea1b5a44a..0b9ad59628 100755
--- a/python/uv/private/template/uv_pip_compile.bat
+++ b/python/uv/private/template/uv_pip_compile.bat
@@ -1,8 +1,19 @@
 @echo off
-if not defined BUILD_WORKSPACE_DIRECTORY goto :else
+if not defined BUILD_WORKSPACE_DIRECTORY goto :build
+
 set "out=%BUILD_WORKSPACE_DIRECTORY%\{{src_out}}"
 "{{args}}" --output-file "%out%" %*
 exit /b %ERRORLEVEL%
 
-:else
-"{{args}}" %*
+:build
+set "out={{out}}"
+if exist "{{src_out}}" copy /Y "{{src_out}}" "%out%" >nul
+set "__srcs="$SRCS""
+if defined __srcs (
+    for %%s in (%__srcs%) do (
+        for %%d in ("{{rootdir}}\%%s") do mkdir "%%~dpd" >nul 2>&1
+        copy /Y "%%s" "{{rootdir}}\%%s" >nul
+    )
+)
+"{{args}}"
+exit /b %ERRORLEVEL%
\ No newline at end of file

From f190c9a655658f34d6d849b404ff74435ebc6158 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Mon, 10 Aug 2026 23:12:56 +0900
Subject: [PATCH 06/16] remove the script

---
 script.sh | 18 ------------------
 1 file changed, 18 deletions(-)
 delete mode 100755 script.sh

diff --git a/script.sh b/script.sh
deleted file mode 100755
index 9163fde5cf..0000000000
--- a/script.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-
-args=(
-    uv
-    pip
-    compile
-    "--generate-hashes"
-    "--no-strip-extras"
-)
-
-"${args[@]}" \
-    --directory examples/bzlmod \
-    requirements.in \
-    --python-version=3.9 \
-    --output-file requirements_lock_3_9.txt \
-    --universal \
-    --custom-compile-command="bazel run //examples:bzlmod_requirements_3_9.update" \
-    --emit-index-url

From 090984effa2c0886341ee432e600bf72f89f9d5e Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Wed, 26 Aug 2026 00:59:40 -0700
Subject: [PATCH 07/16] fix(uv): add Windows batch template support and fix
 path remapping

Support Windows cmd execution in uv lock and pip-compile action templates,
and correctly remap arguments, relative paths, and output targets when
using the directory attribute or nested projects.
---
 python/uv/private/lock.bzl                    | 153 +++++++++---------
 python/uv/private/template/uv_lock.bat        |  18 +--
 python/uv/private/template/uv_lock.sh         |  38 +----
 python/uv/private/template/uv_pip_compile.bat |   7 -
 python/uv/private/template/uv_pip_compile.sh  |  13 --
 tests/uv/lock/lock_run_test.py                |  57 ++++++-
 tests/uv/lock/lock_tests.bzl                  |  84 ++++++++++
 .../lock/testdata/requirements_directory.txt  | 136 ++++++++++++++++
 8 files changed, 362 insertions(+), 144 deletions(-)
 create mode 100755 tests/uv/lock/testdata/requirements_directory.txt

diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 8359cbe370..3328a00144 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -37,48 +37,56 @@ _RunLockInfo = provider(
 def _args(ctx):
     """A small helper to ensure that the right args are pushed to the _RunLockInfo provider"""
     run_info = []
+    run_shell_list = []
     args = ctx.actions.args()
 
-    def _add_args(arg, maybe_value = None):
+    def _add(arg, maybe_value = None):
         run_info.append(arg)
-        if maybe_value:
-            args.add(arg, maybe_value)
+        run_shell_list.append(arg)
+        args.add(arg)
+        if maybe_value != None:
             run_info.append(maybe_value)
+            run_shell_list.append(maybe_value)
+            args.add(maybe_value)
+
+    def _add_run_shell(arg, maybe_value = None):
+        run_shell_list.append(arg)
+        args.add(arg)
+        if maybe_value != None:
+            run_shell_list.append(maybe_value)
+            args.add(maybe_value)
+
+    def _add_run_info(arg):
+        if type(arg) == "list":
+            run_info.extend(arg)
         else:
-            args.add(arg)
-
-    def _add_all(name, all_args = None, **kwargs):
-        if not all_args and type(name) == "list":
-            all_args = name
-            name = None
-
-        before_each = kwargs.get("before_each")
-        if name:
-            args.add_all(name, all_args, **kwargs)
-            run_info.append(name)
-        else:
-            args.add_all(all_args, **kwargs)
-
-        for arg in all_args:
-            if before_each:
-                run_info.append(before_each)
             run_info.append(arg)
 
     return struct(
         run_info = run_info,
         run_shell = args,
-        add = _add_args,
-        add_all = _add_all,
+        run_shell_list = run_shell_list,
+        add = _add,
+        add_run_shell = _add_run_shell,
+        add_run_info = _add_run_info,
     )
 
 def _reroot(x, directory):
     if not directory:
         return x
 
-    if hasattr(x, "short_path"):
+    if hasattr(x, "path"):
+        x = x.path
+    elif hasattr(x, "short_path"):
         x = x.short_path
 
-    return x[len(directory) + 1:] or "."
+    if x == directory:
+        return "."
+
+    if x.startswith(directory + "/"):
+        return x[len(directory) + 1:]
+
+    fail("File '{}' does not start with directory prefix '{}'".format(x, directory))
 
 def _reroot_all(xs, directory):
     return [
@@ -87,15 +95,16 @@ def _reroot_all(xs, directory):
     ]
 
 def _up(x, directory, short_path = False):
+    if hasattr(x, "short_path") if short_path else hasattr(x, "path"):
+        x = x.short_path if short_path else x.path
+    elif hasattr(x, "path"):
+        x = x.path
+
     if not directory:
         return x
 
-    prefix = "/".join([".."] * (len(directory.split("/"))))
-
-    if short_path:
-        return "{}/{}".format(prefix, x.short_path)
-    else:
-        return "{}/{}".format(prefix, x.path)
+    prefix = "/".join([".."] * len(directory.split("/")))
+    return "{}/{}".format(prefix, x)
 
 def _common_lock(ctx, locker):
     fname = "{}.out".format(ctx.label.name)
@@ -124,40 +133,31 @@ def _common_lock(ctx, locker):
     # * progress_message is the same
     srcs, output_filename, mnemonic, progress_message = locker(args, output)
 
-    args.add_all([
-        "--no-python-downloads",
-        "--no-cache",
-    ])
-    rootdir = "{}/{}".format(ctx.label.package, ctx.label.name)
-    workdir = rootdir
+    args.add("--no-python-downloads")
+    args.add("--no-cache")
 
-    project = None
-    if ctx.attr.project:
-        project = ctx.attr.project
-    else:
+    project = ctx.attr.project
+    if not project:
         # Autodetect the project based on the `pyproject.toml` location - it will be the first src that
         # we see that is named "pyproject.toml"
         for src in srcs:
             if src.basename == "pyproject.toml":
-                if project == None:
-                    project = src.dirname
-                elif len(project) > len(src.dirname):
+                if not project or len(project) > len(src.dirname):
                     # select the shortest match
                     project = src.dirname
 
     directory = ctx.attr.directory
     if directory:
-        workdir = "{}/{}".format(workdir, directory)
-        args.run_shell.add("--directory={}".format(workdir))
-        args.run_info.append("--directory={}".format(directory))
-
-    if project == None:
-        project = ctx.label.package
+        args.add_run_shell("--directory={}".format(directory))
+        args.add_run_info("--directory={}".format(directory))
 
     if project:
-        args.add_all([_reroot(project, directory)], before_each = "--project")
+        rerooted_project = _reroot(project, directory)
+        if rerooted_project:
+            args.add("--project", rerooted_project)
 
-    args.add_all(ctx.attr.args)
+    for arg in ctx.attr.args:
+        args.add(arg)
 
     exec_tools = ctx.toolchains[EXEC_TOOLS_TOOLCHAIN_TYPE].exec_tools
     runtime = exec_tools.exec_interpreter[platform_common.ToolchainInfo].py3_runtime
@@ -165,25 +165,24 @@ def _common_lock(ctx, locker):
     python_files = runtime.files or depset()
 
     # Handle python
-    args.run_shell.add("--python", _up(python, workdir))
-    args.run_info.extend(["--python", _up(python, directory, short_path = True)])
+    args.add_run_shell("--python", _up(python, directory))
+    args.add_run_info(["--python", _up(python, directory, short_path = True)])
 
     # These arguments does not change behaviour, but it reduces the output from
     # the command, which is especially verbose in stderr.
     args.add("--no-progress")
     args.add("--quiet")
 
+    project_dir = project or ctx.label.package
+    project_lock = "{}/uv.lock".format(project_dir) if project_dir else "uv.lock"
+
     if ctx.files.existing_output:
         src_out = ctx.files.existing_output[0].path
     elif output_filename:
         # special case - the output filename has to be in the source tree and it has to have a
         # special name, we use the project folder to determine this.
-
-        if not project:
-            fail("Cannot lock this if the project dir is unset or cannot be infered")
-
         src_out = "{project}/{out_filename}".format(
-            project = project,
+            project = project_dir,
             out_filename = output_filename,
         )
     else:
@@ -199,12 +198,13 @@ def _common_lock(ctx, locker):
 
     output_path = output.path.replace("/", path_sep) if is_windows else output.path
     src_out_path = src_out.replace("/", path_sep) if is_windows else src_out
+    project_lock_path = project_lock.replace("/", path_sep) if is_windows else project_lock
 
     # On Windows, all args must be embedded in the .bat script because
     # arguments are not passed on the command line.
     if is_windows:
         args_parts = []
-        for i, arg in enumerate(args.run_info):
+        for i, arg in enumerate(args.run_shell_list):
             if hasattr(arg, "path"):
                 arg = arg.path
 
@@ -214,28 +214,20 @@ def _common_lock(ctx, locker):
             if i == 0:
                 a = arg.replace("/", "\\")
             else:
-                a = arg
+                a = str(arg)
             a = a.replace('"', '""')
             args_parts.append('"' + a + '"')
-
-        # uv pip compile adds --output-file to run_shell (not run_info).
-        # For the lock case, output_filename is "uv.lock" and uv lock
-        # writes to the project directory without --output-file.
-        if not output_filename:
-            args_parts.append('"--output-file"')
-            args_parts.append('"' + output_path + '"')
         windows_args = " ".join(args_parts)
     else:
-        windows_args = " ".join([])
+        windows_args = ""
 
     script = ctx.actions.declare_file(ctx.label.name + "_lock" + ext)
     ctx.actions.expand_template(
         template = ctx.files._template[0],
         substitutions = {
-            '"$SRCS"': " ".join([s.path for s in srcs]),
             '"{{args}}"': windows_args,
             "{{out}}": output_path,
-            "{{rootdir}}": rootdir,
+            "{{project_lock}}": project_lock_path,
             "{{src_out}}": src_out_path,
         },
         output = script,
@@ -281,7 +273,8 @@ def _common_lock(ctx, locker):
 
 def _pip_compile_impl(ctx):
     def _setup_args(args, output):
-        args.add_all(["pip", "compile"])
+        args.add("pip")
+        args.add("compile")
         pkg = ctx.label.package
         update_target = ctx.attr.update_target
         args.add("--custom-compile-command", "bazel run //{}:{}".format(pkg, update_target))
@@ -293,15 +286,17 @@ def _pip_compile_impl(ctx):
 
         directory = ctx.attr.directory
 
-        # TODO @aignas 2026-08-04: fix the --directory handling
-        args.add_all(_reroot_all(ctx.files.build_constraints, directory), before_each = "--build-constraints")
-        args.add_all(_reroot_all(ctx.files.constraints, directory), before_each = "--constraints")
+        for constraint in _reroot_all(ctx.files.build_constraints, directory):
+            args.add("--build-constraints", constraint)
+        for constraint in _reroot_all(ctx.files.constraints, directory):
+            args.add("--constraints", constraint)
 
-        args.run_shell.add("--output-file", _reroot(output, directory))
+        args.add_run_shell("--output-file", _up(output, directory))
         mnemonic = "PyRequirementsLockUv"
         progress_message = "Creating a requirements.txt with uv: %{label}"
 
-        args.add_all(_reroot_all(ctx.files.srcs, directory))
+        for src in _reroot_all(ctx.files.srcs, directory):
+            args.add(src)
         srcs = ctx.files.srcs + ctx.files.build_constraints + ctx.files.constraints
 
         return srcs, None, mnemonic, progress_message
@@ -730,3 +725,9 @@ def lock(
         tags = tags,
         **kwargs
     )
+
+testing = struct(
+    reroot = _reroot,
+    reroot_all = _reroot_all,
+    up = _up,
+)
diff --git a/python/uv/private/template/uv_lock.bat b/python/uv/private/template/uv_lock.bat
index d4f4558c53..f272b20fa8 100755
--- a/python/uv/private/template/uv_lock.bat
+++ b/python/uv/private/template/uv_lock.bat
@@ -4,18 +4,12 @@ if not defined BUILD_WORKSPACE_DIRECTORY goto :not_in_workspace
 exit /b %ERRORLEVEL%
 
 :not_in_workspace
-
-if not exist "{{src_out}}" goto :no_src_out
-copy /y "{{src_out}}" "{{out}}"
-del /f "{{src_out}}"
-copy /y "{{out}}" "{{src_out}}"
-"{{args}}" %*
-set "exit_code=%ERRORLEVEL%"
-copy /y "{{src_out}}" "{{out}}"
-exit /b %exit_code%
-
-:no_src_out
+if exist "{{src_out}}" copy /y "{{src_out}}" "{{out}}" >nul
+if exist "{{out}}" (
+    for %%d in ("{{project_lock}}") do mkdir "%%~dpd" >nul 2>&1
+    copy /y "{{out}}" "{{project_lock}}" >nul
+)
 "{{args}}" %*
 set "exit_code=%ERRORLEVEL%"
-copy /y "{{src_out}}" "{{out}}"
+if exist "{{project_lock}}" copy /y "{{project_lock}}" "{{out}}" >nul
 exit /b %exit_code%
\ No newline at end of file
diff --git a/python/uv/private/template/uv_lock.sh b/python/uv/private/template/uv_lock.sh
index 11d6bacdf7..eacd69e737 100755
--- a/python/uv/private/template/uv_lock.sh
+++ b/python/uv/private/template/uv_lock.sh
@@ -1,44 +1,18 @@
 #!/usr/bin/env bash
-set -euxo pipefail
+set -euo pipefail
 
 if [[ -n "${BUILD_WORKSPACE_DIRECTORY:-}" ]]; then
     exec "{{args}}" "$@"
 fi
 
 # Build action mode
-#
-# If the uv.lock exists, remove because the existing uv.lock file is read-only, then symlink so
-# that we can reuse the existing contents and not do a full relock all the time. If
-# nothing exists, just symlink.
-#
-# On Windows we do it with file copies:
-# 1. If the file exists:
-#    1. Copy the current file to out.
-#    2. Rm the existing file
-#    3. Copy the contents back
-#    4. Run uv
-#    5. Copy the contents to out.
-# 1. If the current uv.lock does not exist yet
-#    1. Run uv
-#    2. Copy the contents to out.
-
-# Copy all of the sources under a new directory, so that `directory` arg is working
-# as expected and we can reroot the sources if needed. This also is a starting point
-# to get the workspaces working properly in the sandbox - with this copying of sources
-# we can remap the paths if needed, but that would require another attribute.
-for src in "${cp_srcs[@]}"; do
-    # First create a dir if it does not exist
-    mkdir -p "$(dirname "{{rootdir}}/$src")"
-    # Then copy the source to the dir
-    cp -v "$src" "{{rootdir}}/$src"
-done
 readonly out="{{out}}"
 if [[ -f "{{src_out}}" ]]; then
     cp "{{src_out}}" "$out"
-    mkdir -p "$(dirname "{{rootdir}}/{{src_out}}")"
-    ln -s "$(pwd)"/"$out" "{{rootdir}}/{{src_out}}"
-else
-    mkdir -p "$(dirname "{{rootdir}}/{{src_out}}")"
-    ln -s "$(pwd)"/"$out" "{{rootdir}}/{{src_out}}"
 fi
+if [[ -e "{{project_lock}}" ]]; then
+    rm -f "{{project_lock}}"
+fi
+mkdir -p "$(dirname "{{project_lock}}")"
+ln -s "$(pwd)"/"$out" "{{project_lock}}"
 exec "$@"
diff --git a/python/uv/private/template/uv_pip_compile.bat b/python/uv/private/template/uv_pip_compile.bat
index 0b9ad59628..f04bc2ee56 100755
--- a/python/uv/private/template/uv_pip_compile.bat
+++ b/python/uv/private/template/uv_pip_compile.bat
@@ -8,12 +8,5 @@ exit /b %ERRORLEVEL%
 :build
 set "out={{out}}"
 if exist "{{src_out}}" copy /Y "{{src_out}}" "%out%" >nul
-set "__srcs="$SRCS""
-if defined __srcs (
-    for %%s in (%__srcs%) do (
-        for %%d in ("{{rootdir}}\%%s") do mkdir "%%~dpd" >nul 2>&1
-        copy /Y "%%s" "{{rootdir}}\%%s" >nul
-    )
-)
 "{{args}}"
 exit /b %ERRORLEVEL%
\ No newline at end of file
diff --git a/python/uv/private/template/uv_pip_compile.sh b/python/uv/private/template/uv_pip_compile.sh
index 983e296d48..ba379ed0f9 100755
--- a/python/uv/private/template/uv_pip_compile.sh
+++ b/python/uv/private/template/uv_pip_compile.sh
@@ -12,17 +12,4 @@ readonly out="{{out}}"
 if [[ -f "{{src_out}}" ]]; then
     cp "{{src_out}}" "$out"
 fi
-cp_srcs=(
-    "$SRCS"
-)
-# Copy all of the sources under a new directory, so that `directory` arg is working
-# as expected and we can reroot the sources if needed. This also is a starting point
-# to get the workspaces working properly in the sandbox - with this copying of sources
-# we can remap the paths if needed, but that would require another attribute.
-for src in "${cp_srcs[@]}"; do
-    # First create a dir if it does not exist
-    mkdir -p "$(dirname "{{rootdir}}/$src")"
-    # Then copy the source to the dir
-    cp -v "$src" "{{rootdir}}/$src"
-done
 exec "$@"
diff --git a/tests/uv/lock/lock_run_test.py b/tests/uv/lock/lock_run_test.py
index 2de9147d99..956dc47fd6 100644
--- a/tests/uv/lock/lock_run_test.py
+++ b/tests/uv/lock/lock_run_test.py
@@ -255,9 +255,26 @@ def test_requirements_run_script_has_expected_args(self):
         self.assertIn("--output-file", content)
         self.assertIn("requirements.txt", content)
 
-    def test_requirements_run(self):
+    def test_requirements_directory_run_script_has_expected_args(self):
+        """Verify the .run script template for directory attribute has --directory embedded."""
+        run_script_path = _relative_rpath("requirements_directory.run")
+        content = run_script_path.read_text()
+
+        self.assertIn("--directory=tests/uv/lock/testdata", content)
+        self.assertIn("BUILD_WORKSPACE_DIRECTORY", content)
+        self.assertIn("requirements_directory.txt", content)
+
+    def test_uv_lock_directory_run_script_has_expected_args(self):
+        """Verify the uv lock .run script with directory has --directory embedded."""
+        run_script_path = _relative_rpath("uv_lock_directory_test.run")
+        content = run_script_path.read_text()
+
+        self.assertIn("--directory=tests/uv/lock/testdata", content)
+        self.assertIn("BUILD_WORKSPACE_DIRECTORY", content)
+
+    def test_requirements_directory_updating(self):
         # Given
-        copier_path = _relative_rpath("requirements.run")
+        copier_path = _relative_rpath("requirements_directory.update")
 
         # When
         with tempfile.TemporaryDirectory() as dir:
@@ -268,7 +285,40 @@ def test_requirements_run(self):
                 / "uv"
                 / "lock"
                 / "testdata"
-                / "requirements.txt"
+                / "requirements_directory.txt"
+            )
+            want_path.parent.mkdir(parents=True)
+
+            output = _run_binary(
+                copier_path,
+                capture_output=True,
+                env=self._subprocess_env(workspace_dir),
+            )
+
+            # Then
+            self.assertEqual(0, output.returncode)
+            stdout = output.stdout.decode("utf-8").replace("\\", "/")
+            self.assertIn(
+                "cp <bazel-sandbox>/tests/uv/lock/requirements_directory",
+                stdout,
+            )
+            self.assertTrue(want_path.exists(), "The path should exist after the test")
+            self.assertNotEqual(want_path.read_text(), "")
+
+    def test_requirements_directory_run(self):
+        # Given
+        copier_path = _relative_rpath("requirements_directory.run")
+
+        # When
+        with tempfile.TemporaryDirectory() as dir:
+            workspace_dir = Path(dir)
+            want_path = (
+                workspace_dir
+                / "tests"
+                / "uv"
+                / "lock"
+                / "testdata"
+                / "requirements_directory.txt"
             )
             want_path.parent.mkdir(parents=True)
 
@@ -283,7 +333,6 @@ def test_requirements_run(self):
             self.assertTrue(want_path.exists(), "The path should exist after the test")
             got_contents = want_path.read_text()
             self.assertNotEqual(got_contents, "")
-            # NOTE: stdout is typically empty because uv runs with --quiet --no-progress
 
 
 if __name__ == "__main__":
diff --git a/tests/uv/lock/lock_tests.bzl b/tests/uv/lock/lock_tests.bzl
index e3e035717f..3ea2e89456 100644
--- a/tests/uv/lock/lock_tests.bzl
+++ b/tests/uv/lock/lock_tests.bzl
@@ -16,9 +16,42 @@
 
 load("@bazel_skylib//rules:diff_test.bzl", "diff_test")
 load("@bazel_skylib//rules:native_binary.bzl", "native_test")
+load("@rules_testing//lib:test_suite.bzl", "test_suite")
 load("//python/uv:lock.bzl", "lock")
+load("//python/uv/private:lock.bzl", lock_testing = "testing")  # buildifier: disable=bzl-visibility
 load("//tests/support:py_reconfig.bzl", "py_reconfig_test")
 
+_basic_tests = []
+
+def _test_reroot(env):
+    reroot = lock_testing.reroot
+    env.expect.that_str(reroot("dev/requirements.in", "dev")).equals("requirements.in")
+    env.expect.that_str(reroot("dev/sub/pkg.txt", "dev")).equals("sub/pkg.txt")
+    env.expect.that_str(reroot("dev", "dev")).equals(".")
+    env.expect.that_str(reroot("a/b/c/foo.txt", "a/b")).equals("c/foo.txt")
+    env.expect.that_str(reroot("requirements.in", None)).equals("requirements.in")
+    env.expect.that_str(reroot("requirements.in", "")).equals("requirements.in")
+
+_basic_tests.append(_test_reroot)
+
+def _test_reroot_all(env):
+    reroot_all = lock_testing.reroot_all
+    env.expect.that_collection(
+        reroot_all(["dev/a.txt", "dev/b.txt"], "dev"),
+    ).contains_exactly(["a.txt", "b.txt"]).in_order()
+
+_basic_tests.append(_test_reroot_all)
+
+def _test_up(env):
+    up = lock_testing.up
+    env.expect.that_str(up("foo/bar", None)).equals("foo/bar")
+    env.expect.that_str(up("foo/bar", "")).equals("foo/bar")
+    env.expect.that_str(up("foo/bar", "dev")).equals("../foo/bar")
+    env.expect.that_str(up("foo/bar", "examples/bzlmod")).equals("../../foo/bar")
+    env.expect.that_str(up("foo/bar", "a/b/c")).equals("../../../foo/bar")
+
+_basic_tests.append(_test_up)
+
 def lock_test_suite(name):
     """The test suite with various lock-related integration tests
 
@@ -42,6 +75,22 @@ def lock_test_suite(name):
         out = "testdata/requirements.txt",
     )
 
+    lock(
+        name = "requirements_directory",
+        srcs = ["testdata/requirements.in"],
+        constraints = [
+            "testdata/constraints.txt",
+            "testdata/constraints2.txt",
+        ],
+        build_constraints = [
+            "testdata/build_constraints.txt",
+            "testdata/build_constraints2.txt",
+        ],
+        directory = "tests/uv/lock/testdata",
+        tags = ["no-remote-exec"],
+        out = "testdata/requirements_directory.txt",
+    )
+
     lock(
         name = "requirements_new_file",
         srcs = ["testdata/requirements.in"],
@@ -65,9 +114,14 @@ def lock_test_suite(name):
             "requirements_new_file.run",
             "requirements.update",
             "requirements.run",
+            "requirements_directory.update",
+            "requirements_directory.run",
             "testdata/requirements.txt",
+            "testdata/requirements_directory.txt",
             "uv_lock_test.run",
+            "uv_lock_directory_test.run",
             ":requirements",
+            ":requirements_directory",
         ],
         main = "lock_run_test.py",
         tags = [
@@ -90,6 +144,13 @@ def lock_test_suite(name):
         file2 = "testdata/requirements.txt",
     )
 
+    diff_test(
+        name = "requirements_directory_test",
+        timeout = "short",
+        file1 = ":requirements_directory",
+        file2 = "testdata/requirements_directory.txt",
+    )
+
     lock(
         name = "uv_lock_test",
         srcs = ["testdata/pyproject.toml"],
@@ -97,6 +158,21 @@ def lock_test_suite(name):
         tags = ["no-remote-exec"],
     )
 
+    lock(
+        name = "uv_lock_directory_test",
+        srcs = ["testdata/pyproject.toml"],
+        directory = "tests/uv/lock/testdata",
+        out = "testdata/uv_lock_expected.lock",
+        tags = ["no-remote-exec"],
+    )
+
+    diff_test(
+        name = "uv_lock_directory_diff_test",
+        timeout = "short",
+        file1 = ":uv_lock_directory_test",
+        file2 = "testdata/uv_lock_expected.lock",
+    )
+
     native_test(
         name = "uv_lock_test_check",
         src = ":uv_lock_test.update",
@@ -106,12 +182,20 @@ def lock_test_suite(name):
         }),
     )
 
+    test_suite(
+        name = name + "_basic",
+        basic_tests = _basic_tests,
+    )
+
     native.test_suite(
         name = name,
         tests = [
+            ":" + name + "_basic",
             ":requirements_test",
+            ":requirements_directory_test",
             "//tests/uv/lock/pyproject_toml:requirements_test",
             ":requirements_run_tests",
             ":uv_lock_test_check",
+            ":uv_lock_directory_diff_test",
         ],
     )
diff --git a/tests/uv/lock/testdata/requirements_directory.txt b/tests/uv/lock/testdata/requirements_directory.txt
new file mode 100755
index 0000000000..52f64c5642
--- /dev/null
+++ b/tests/uv/lock/testdata/requirements_directory.txt
@@ -0,0 +1,136 @@
+# This file was autogenerated by uv via the following command:
+#    bazel run //tests/uv/lock:requirements_directory.update
+certifi==2025.1.31 \
+    --hash=sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651 \
+    --hash=sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe
+    # via
+    #   -c constraints.txt
+    #   requests
+charset-normalizer==3.4.0 \
+    --hash=sha256:0099d79bdfcf5c1f0c2c72f91516702ebf8b0b8ddd8905f97a8aecf49712c621 \
+    --hash=sha256:0713f3adb9d03d49d365b70b84775d0a0d18e4ab08d12bc46baa6132ba78aaf6 \
+    --hash=sha256:07afec21bbbbf8a5cc3651aa96b980afe2526e7f048fdfb7f1014d84acc8b6d8 \
+    --hash=sha256:0b309d1747110feb25d7ed6b01afdec269c647d382c857ef4663bbe6ad95a912 \
+    --hash=sha256:0d99dd8ff461990f12d6e42c7347fd9ab2532fb70e9621ba520f9e8637161d7c \
+    --hash=sha256:0de7b687289d3c1b3e8660d0741874abe7888100efe14bd0f9fd7141bcbda92b \
+    --hash=sha256:1110e22af8ca26b90bd6364fe4c763329b0ebf1ee213ba32b68c73de5752323d \
+    --hash=sha256:130272c698667a982a5d0e626851ceff662565379baf0ff2cc58067b81d4f11d \
+    --hash=sha256:136815f06a3ae311fae551c3df1f998a1ebd01ddd424aa5603a4336997629e95 \
+    --hash=sha256:14215b71a762336254351b00ec720a8e85cada43b987da5a042e4ce3e82bd68e \
+    --hash=sha256:1db4e7fefefd0f548d73e2e2e041f9df5c59e178b4c72fbac4cc6f535cfb1565 \
+    --hash=sha256:1ffd9493de4c922f2a38c2bf62b831dcec90ac673ed1ca182fe11b4d8e9f2a64 \
+    --hash=sha256:2006769bd1640bdf4d5641c69a3d63b71b81445473cac5ded39740a226fa88ab \
+    --hash=sha256:20587d20f557fe189b7947d8e7ec5afa110ccf72a3128d61a2a387c3313f46be \
+    --hash=sha256:223217c3d4f82c3ac5e29032b3f1c2eb0fb591b72161f86d93f5719079dae93e \
+    --hash=sha256:27623ba66c183eca01bf9ff833875b459cad267aeeb044477fedac35e19ba907 \
+    --hash=sha256:285e96d9d53422efc0d7a17c60e59f37fbf3dfa942073f666db4ac71e8d726d0 \
+    --hash=sha256:2de62e8801ddfff069cd5c504ce3bc9672b23266597d4e4f50eda28846c322f2 \
+    --hash=sha256:2f6c34da58ea9c1a9515621f4d9ac379871a8f21168ba1b5e09d74250de5ad62 \
+    --hash=sha256:309a7de0a0ff3040acaebb35ec45d18db4b28232f21998851cfa709eeff49d62 \
+    --hash=sha256:35c404d74c2926d0287fbd63ed5d27eb911eb9e4a3bb2c6d294f3cfd4a9e0c23 \
+    --hash=sha256:3710a9751938947e6327ea9f3ea6332a09bf0ba0c09cae9cb1f250bd1f1549bc \
+    --hash=sha256:3d59d125ffbd6d552765510e3f31ed75ebac2c7470c7274195b9161a32350284 \
+    --hash=sha256:40d3ff7fc90b98c637bda91c89d51264a3dcf210cade3a2c6f838c7268d7a4ca \
+    --hash=sha256:425c5f215d0eecee9a56cdb703203dda90423247421bf0d67125add85d0c4455 \
+    --hash=sha256:43193c5cda5d612f247172016c4bb71251c784d7a4d9314677186a838ad34858 \
+    --hash=sha256:44aeb140295a2f0659e113b31cfe92c9061622cadbc9e2a2f7b8ef6b1e29ef4b \
+    --hash=sha256:47334db71978b23ebcf3c0f9f5ee98b8d65992b65c9c4f2d34c2eaf5bcaf0594 \
+    --hash=sha256:4796efc4faf6b53a18e3d46343535caed491776a22af773f366534056c4e1fbc \
+    --hash=sha256:4a51b48f42d9358460b78725283f04bddaf44a9358197b889657deba38f329db \
+    --hash=sha256:4b67fdab07fdd3c10bb21edab3cbfe8cf5696f453afce75d815d9d7223fbe88b \
+    --hash=sha256:4ec9dd88a5b71abfc74e9df5ebe7921c35cbb3b641181a531ca65cdb5e8e4dea \
+    --hash=sha256:4f9fc98dad6c2eaa32fc3af1417d95b5e3d08aff968df0cd320066def971f9a6 \
+    --hash=sha256:54b6a92d009cbe2fb11054ba694bc9e284dad30a26757b1e372a1fdddaf21920 \
+    --hash=sha256:55f56e2ebd4e3bc50442fbc0888c9d8c94e4e06a933804e2af3e89e2f9c1c749 \
+    --hash=sha256:5726cf76c982532c1863fb64d8c6dd0e4c90b6ece9feb06c9f202417a31f7dd7 \
+    --hash=sha256:5d447056e2ca60382d460a604b6302d8db69476fd2015c81e7c35417cfabe4cd \
+    --hash=sha256:5ed2e36c3e9b4f21dd9422f6893dec0abf2cca553af509b10cd630f878d3eb99 \
+    --hash=sha256:5ff2ed8194587faf56555927b3aa10e6fb69d931e33953943bc4f837dfee2242 \
+    --hash=sha256:62f60aebecfc7f4b82e3f639a7d1433a20ec32824db2199a11ad4f5e146ef5ee \
+    --hash=sha256:63bc5c4ae26e4bc6be6469943b8253c0fd4e4186c43ad46e713ea61a0ba49129 \
+    --hash=sha256:6b40e8d38afe634559e398cc32b1472f376a4099c75fe6299ae607e404c033b2 \
+    --hash=sha256:6b493a043635eb376e50eedf7818f2f322eabbaa974e948bd8bdd29eb7ef2a51 \
+    --hash=sha256:6dba5d19c4dfab08e58d5b36304b3f92f3bd5d42c1a3fa37b5ba5cdf6dfcbcee \
+    --hash=sha256:6fd30dc99682dc2c603c2b315bded2799019cea829f8bf57dc6b61efde6611c8 \
+    --hash=sha256:707b82d19e65c9bd28b81dde95249b07bf9f5b90ebe1ef17d9b57473f8a64b7b \
+    --hash=sha256:7706f5850360ac01d80c89bcef1640683cc12ed87f42579dab6c5d3ed6888613 \
+    --hash=sha256:7782afc9b6b42200f7362858f9e73b1f8316afb276d316336c0ec3bd73312742 \
+    --hash=sha256:79983512b108e4a164b9c8d34de3992f76d48cadc9554c9e60b43f308988aabe \
+    --hash=sha256:7f683ddc7eedd742e2889d2bfb96d69573fde1d92fcb811979cdb7165bb9c7d3 \
+    --hash=sha256:82357d85de703176b5587dbe6ade8ff67f9f69a41c0733cf2425378b49954de5 \
+    --hash=sha256:84450ba661fb96e9fd67629b93d2941c871ca86fc38d835d19d4225ff946a631 \
+    --hash=sha256:86f4e8cca779080f66ff4f191a685ced73d2f72d50216f7112185dc02b90b9b7 \
+    --hash=sha256:8cda06946eac330cbe6598f77bb54e690b4ca93f593dee1568ad22b04f347c15 \
+    --hash=sha256:8ce7fd6767a1cc5a92a639b391891bf1c268b03ec7e021c7d6d902285259685c \
+    --hash=sha256:8ff4e7cdfdb1ab5698e675ca622e72d58a6fa2a8aa58195de0c0061288e6e3ea \
+    --hash=sha256:9289fd5dddcf57bab41d044f1756550f9e7cf0c8e373b8cdf0ce8773dc4bd417 \
+    --hash=sha256:92a7e36b000bf022ef3dbb9c46bfe2d52c047d5e3f3343f43204263c5addc250 \
+    --hash=sha256:92db3c28b5b2a273346bebb24857fda45601aef6ae1c011c0a997106581e8a88 \
+    --hash=sha256:95c3c157765b031331dd4db3c775e58deaee050a3042fcad72cbc4189d7c8dca \
+    --hash=sha256:980b4f289d1d90ca5efcf07958d3eb38ed9c0b7676bf2831a54d4f66f9c27dfa \
+    --hash=sha256:9ae4ef0b3f6b41bad6366fb0ea4fc1d7ed051528e113a60fa2a65a9abb5b1d99 \
+    --hash=sha256:9c98230f5042f4945f957d006edccc2af1e03ed5e37ce7c373f00a5a4daa6149 \
+    --hash=sha256:9fa2566ca27d67c86569e8c85297aaf413ffab85a8960500f12ea34ff98e4c41 \
+    --hash=sha256:a14969b8691f7998e74663b77b4c36c0337cb1df552da83d5c9004a93afdb574 \
+    --hash=sha256:a8aacce6e2e1edcb6ac625fb0f8c3a9570ccc7bfba1f63419b3769ccf6a00ed0 \
+    --hash=sha256:a8e538f46104c815be19c975572d74afb53f29650ea2025bbfaef359d2de2f7f \
+    --hash=sha256:aa41e526a5d4a9dfcfbab0716c7e8a1b215abd3f3df5a45cf18a12721d31cb5d \
+    --hash=sha256:aa693779a8b50cd97570e5a0f343538a8dbd3e496fa5dcb87e29406ad0299654 \
+    --hash=sha256:ab22fbd9765e6954bc0bcff24c25ff71dcbfdb185fcdaca49e81bac68fe724d3 \
+    --hash=sha256:ab2e5bef076f5a235c3774b4f4028a680432cded7cad37bba0fd90d64b187d19 \
+    --hash=sha256:ab973df98fc99ab39080bfb0eb3a925181454d7c3ac8a1e695fddfae696d9e90 \
+    --hash=sha256:af73657b7a68211996527dbfeffbb0864e043d270580c5aef06dc4b659a4b578 \
+    --hash=sha256:b197e7094f232959f8f20541ead1d9862ac5ebea1d58e9849c1bf979255dfac9 \
+    --hash=sha256:b295729485b06c1a0683af02a9e42d2caa9db04a373dc38a6a58cdd1e8abddf1 \
+    --hash=sha256:b8831399554b92b72af5932cdbbd4ddc55c55f631bb13ff8fe4e6536a06c5c51 \
+    --hash=sha256:b8dcd239c743aa2f9c22ce674a145e0a25cb1566c495928440a181ca1ccf6719 \
+    --hash=sha256:bcb4f8ea87d03bc51ad04add8ceaf9b0f085ac045ab4d74e73bbc2dc033f0236 \
+    --hash=sha256:bd7af3717683bea4c87acd8c0d3d5b44d56120b26fd3f8a692bdd2d5260c620a \
+    --hash=sha256:bf4475b82be41b07cc5e5ff94810e6a01f276e37c2d55571e3fe175e467a1a1c \
+    --hash=sha256:c3e446d253bd88f6377260d07c895816ebf33ffffd56c1c792b13bff9c3e1ade \
+    --hash=sha256:c57516e58fd17d03ebe67e181a4e4e2ccab1168f8c2976c6a334d4f819fe5944 \
+    --hash=sha256:c94057af19bc953643a33581844649a7fdab902624d2eb739738a30e2b3e60fc \
+    --hash=sha256:cab5d0b79d987c67f3b9e9c53f54a61360422a5a0bc075f43cab5621d530c3b6 \
+    --hash=sha256:ce031db0408e487fd2775d745ce30a7cd2923667cf3b69d48d219f1d8f5ddeb6 \
+    --hash=sha256:cee4373f4d3ad28f1ab6290684d8e2ebdb9e7a1b74fdc39e4c211995f77bec27 \
+    --hash=sha256:d5b054862739d276e09928de37c79ddeec42a6e1bfc55863be96a36ba22926f6 \
+    --hash=sha256:dbe03226baf438ac4fda9e2d0715022fd579cb641c4cf639fa40d53b2fe6f3e2 \
+    --hash=sha256:dc15e99b2d8a656f8e666854404f1ba54765871104e50c8e9813af8a7db07f12 \
+    --hash=sha256:dcaf7c1524c0542ee2fc82cc8ec337f7a9f7edee2532421ab200d2b920fc97cf \
+    --hash=sha256:dd4eda173a9fcccb5f2e2bd2a9f423d180194b1bf17cf59e3269899235b2a114 \
+    --hash=sha256:dd9a8bd8900e65504a305bf8ae6fa9fbc66de94178c420791d0293702fce2df7 \
+    --hash=sha256:de7376c29d95d6719048c194a9cf1a1b0393fbe8488a22008610b0361d834ecf \
+    --hash=sha256:e7fdd52961feb4c96507aa649550ec2a0d527c086d284749b2f582f2d40a2e0d \
+    --hash=sha256:e91f541a85298cf35433bf66f3fab2a4a2cff05c127eeca4af174f6d497f0d4b \
+    --hash=sha256:e9e3c4c9e1ed40ea53acf11e2a386383c3304212c965773704e4603d589343ed \
+    --hash=sha256:ee803480535c44e7f5ad00788526da7d85525cfefaf8acf8ab9a310000be4b03 \
+    --hash=sha256:f09cb5a7bbe1ecae6e87901a2eb23e0256bb524a79ccc53eb0b7629fbe7677c4 \
+    --hash=sha256:f19c1585933c82098c2a520f8ec1227f20e339e33aca8fa6f956f6691b784e67 \
+    --hash=sha256:f1a2f519ae173b5b6a2c9d5fa3116ce16e48b3462c8b96dfdded11055e3d6365 \
+    --hash=sha256:f28f891ccd15c514a0981f3b9db9aa23d62fe1a99997512b0491d2ed323d229a \
+    --hash=sha256:f3e73a4255342d4eb26ef6df01e3962e73aa29baa3124a8e824c5d3364a65748 \
+    --hash=sha256:f606a1881d2663630ea5b8ce2efe2111740df4b687bd78b34a8131baa007f79b \
+    --hash=sha256:fe9f97feb71aa9896b81973a7bbada8c49501dc73e58a10fcef6663af95e5079 \
+    --hash=sha256:ffc519621dce0c767e96b9c53f09c5d215578e10b02c285809f76509a3931482
+    # via
+    #   -c constraints.txt
+    #   -c constraints2.txt
+    #   requests
+idna==3.15 \
+    --hash=sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8 \
+    --hash=sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc
+    # via
+    #   -c constraints.txt
+    #   requests
+requests==2.33.0 \
+    --hash=sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b \
+    --hash=sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652
+    # via
+    #   -c constraints.txt
+    #   -r requirements.in
+urllib3==2.7.0 \
+    --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
+    --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
+    # via
+    #   -c constraints.txt
+    #   requests

From da074a77498cf749ae0d310ca0a9142cc1f547c0 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Wed, 26 Aug 2026 01:08:14 -0700
Subject: [PATCH 08/16] test(uv): normalize backslashes when asserting script
 contents in lock_run_test

Ensure assertions on generated script contents in lock_run_test succeed
on Windows where directory path separators are backslashes.
---
 tests/uv/lock/lock_run_test.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/uv/lock/lock_run_test.py b/tests/uv/lock/lock_run_test.py
index 956dc47fd6..139d8bb2c8 100644
--- a/tests/uv/lock/lock_run_test.py
+++ b/tests/uv/lock/lock_run_test.py
@@ -258,7 +258,7 @@ def test_requirements_run_script_has_expected_args(self):
     def test_requirements_directory_run_script_has_expected_args(self):
         """Verify the .run script template for directory attribute has --directory embedded."""
         run_script_path = _relative_rpath("requirements_directory.run")
-        content = run_script_path.read_text()
+        content = run_script_path.read_text().replace("\\", "/")
 
         self.assertIn("--directory=tests/uv/lock/testdata", content)
         self.assertIn("BUILD_WORKSPACE_DIRECTORY", content)
@@ -267,7 +267,7 @@ def test_requirements_directory_run_script_has_expected_args(self):
     def test_uv_lock_directory_run_script_has_expected_args(self):
         """Verify the uv lock .run script with directory has --directory embedded."""
         run_script_path = _relative_rpath("uv_lock_directory_test.run")
-        content = run_script_path.read_text()
+        content = run_script_path.read_text().replace("\\", "/")
 
         self.assertIn("--directory=tests/uv/lock/testdata", content)
         self.assertIn("BUILD_WORKSPACE_DIRECTORY", content)

From 7d5db8e037ff62c7286d9489343156c18d206829 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Wed, 26 Aug 2026 09:55:07 -0700
Subject: [PATCH 09/16] docs(uv): fix docstring formatting, version tag, and
 add news entry

Update directory attribute documentation to use VERSION_NEXT_FEATURE,
remove trailing docstring backslash, wrap Starlark lines to 80 columns,
and add the news entry fragment for PR #4029.
---
 news/4029.added.md           |  3 +++
 python/uv/private/lock.bzl   | 28 +++++++++++++++++-----------
 tests/uv/lock/lock_tests.bzl | 16 ++++++++++++----
 3 files changed, 32 insertions(+), 15 deletions(-)
 create mode 100644 news/4029.added.md

diff --git a/news/4029.added.md b/news/4029.added.md
new file mode 100644
index 0000000000..1d3d6fd3f0
--- /dev/null
+++ b/news/4029.added.md
@@ -0,0 +1,3 @@
+(uv) Added {obj}`directory` attribute to {obj}`lock` to support running `uv`
+commands within subdirectories when generating lock files
+([#4029](https://github.com/bazel-contrib/rules_python/pull/4029)).
diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 3328a00144..d6a2fa460c 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -77,16 +77,16 @@ def _reroot(x, directory):
 
     if hasattr(x, "path"):
         x = x.path
-    elif hasattr(x, "short_path"):
-        x = x.short_path
-
     if x == directory:
         return "."
 
     if x.startswith(directory + "/"):
         return x[len(directory) + 1:]
 
-    fail("File '{}' does not start with directory prefix '{}'".format(x, directory))
+    fail("File '{}' does not start with directory prefix '{}'".format(
+        x,
+        directory,
+    ))
 
 def _reroot_all(xs, directory):
     return [
@@ -174,7 +174,9 @@ def _common_lock(ctx, locker):
     args.add("--quiet")
 
     project_dir = project or ctx.label.package
-    project_lock = "{}/uv.lock".format(project_dir) if project_dir else "uv.lock"
+    project_lock = (
+        "{}/uv.lock".format(project_dir) if project_dir else "uv.lock"
+    )
 
     if ctx.files.existing_output:
         src_out = ctx.files.existing_output[0].path
@@ -196,9 +198,13 @@ def _common_lock(ctx, locker):
         path_sep = "/"
         ext = ""
 
-    output_path = output.path.replace("/", path_sep) if is_windows else output.path
+    output_path = (
+        output.path.replace("/", path_sep) if is_windows else output.path
+    )
     src_out_path = src_out.replace("/", path_sep) if is_windows else src_out
-    project_lock_path = project_lock.replace("/", path_sep) if is_windows else project_lock
+    project_lock_path = (
+        project_lock.replace("/", path_sep) if is_windows else project_lock
+    )
 
     # On Windows, all args must be embedded in the .bat script because
     # arguments are not passed on the command line.
@@ -322,7 +328,7 @@ _common_attrs = {
         doc = "Public, see the docs in the macro.",
     ),
     "directory": attr.string(
-        doc = """\
+        doc = """
 Sets the --directory flag if provided. Will fail if at least one of the files
 does not start with the given prefix of the directory.
 """,
@@ -618,9 +624,9 @@ def lock(
             is passed as is and the environment variables are not expanded.
         build_constraints: {type}`list[Label]` The list of build constraints to use.
         constraints: {type}`list[Label]` The list of constraints files to use.
-        directory: {type}`str` The directory into which we should cd when running
-            the command.
-            {versionadded} VERSION_NEXT_MINOR
+        directory: {type}`str` The directory into which we should cd when
+            running the command.
+            {versionadded} VERSION_NEXT_FEATURE
         generate_hashes: {type}`bool` Generate hashes for all of the
             requirements. Only meaningful for `requirements.txt` style output.
             Defaults to `True`.
diff --git a/tests/uv/lock/lock_tests.bzl b/tests/uv/lock/lock_tests.bzl
index 3ea2e89456..3e15ef2053 100644
--- a/tests/uv/lock/lock_tests.bzl
+++ b/tests/uv/lock/lock_tests.bzl
@@ -25,12 +25,18 @@ _basic_tests = []
 
 def _test_reroot(env):
     reroot = lock_testing.reroot
-    env.expect.that_str(reroot("dev/requirements.in", "dev")).equals("requirements.in")
+    env.expect.that_str(
+        reroot("dev/requirements.in", "dev"),
+    ).equals("requirements.in")
     env.expect.that_str(reroot("dev/sub/pkg.txt", "dev")).equals("sub/pkg.txt")
     env.expect.that_str(reroot("dev", "dev")).equals(".")
     env.expect.that_str(reroot("a/b/c/foo.txt", "a/b")).equals("c/foo.txt")
-    env.expect.that_str(reroot("requirements.in", None)).equals("requirements.in")
-    env.expect.that_str(reroot("requirements.in", "")).equals("requirements.in")
+    env.expect.that_str(
+        reroot("requirements.in", None),
+    ).equals("requirements.in")
+    env.expect.that_str(
+        reroot("requirements.in", ""),
+    ).equals("requirements.in")
 
 _basic_tests.append(_test_reroot)
 
@@ -47,7 +53,9 @@ def _test_up(env):
     env.expect.that_str(up("foo/bar", None)).equals("foo/bar")
     env.expect.that_str(up("foo/bar", "")).equals("foo/bar")
     env.expect.that_str(up("foo/bar", "dev")).equals("../foo/bar")
-    env.expect.that_str(up("foo/bar", "examples/bzlmod")).equals("../../foo/bar")
+    env.expect.that_str(
+        up("foo/bar", "examples/bzlmod"),
+    ).equals("../../foo/bar")
     env.expect.that_str(up("foo/bar", "a/b/c")).equals("../../../foo/bar")
 
 _basic_tests.append(_test_up)

From d422135973f01a911c9052b8cc0e169fd3436e49 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Wed, 26 Aug 2026 17:03:38 -0700
Subject: [PATCH 10/16] docs(uv): place versionadded block directive in lock
 macro docstring

Move :::versionadded VERSION_NEXT_FEATURE directive into the main lock
macro docstring.
---
 python/uv/private/lock.bzl | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index d6a2fa460c..0043154140 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -613,6 +613,9 @@ def lock(
     All of the targets have `manual` tags as locking results cannot be cached.
     :::
 
+    :::{versionadded} VERSION_NEXT_FEATURE
+    :::
+
     Args:
         name: {type}`str` The prefix of all targets created by this macro.
         srcs: {type}`list[Label]` The sources that will be used. Add all of the
@@ -626,7 +629,6 @@ def lock(
         constraints: {type}`list[Label]` The list of constraints files to use.
         directory: {type}`str` The directory into which we should cd when
             running the command.
-            {versionadded} VERSION_NEXT_FEATURE
         generate_hashes: {type}`bool` Generate hashes for all of the
             requirements. Only meaningful for `requirements.txt` style output.
             Defaults to `True`.

From 803280a3474d67a443c52b78013d4402b7030df4 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Wed, 26 Aug 2026 17:05:29 -0700
Subject: [PATCH 11/16] feat(uv): use format=--project=%s style for project
 flag

Support format parameter in _args helper and use args.add(rerooted_project,
format="--project=%s").
---
 python/uv/private/lock.bzl | 43 ++++++++++++++++++++++++--------------
 1 file changed, 27 insertions(+), 16 deletions(-)

diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 0043154140..32c0dc8f8f 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -40,21 +40,32 @@ def _args(ctx):
     run_shell_list = []
     args = ctx.actions.args()
 
-    def _add(arg, maybe_value = None):
-        run_info.append(arg)
-        run_shell_list.append(arg)
-        args.add(arg)
-        if maybe_value != None:
-            run_info.append(maybe_value)
-            run_shell_list.append(maybe_value)
-            args.add(maybe_value)
-
-    def _add_run_shell(arg, maybe_value = None):
-        run_shell_list.append(arg)
-        args.add(arg)
-        if maybe_value != None:
-            run_shell_list.append(maybe_value)
-            args.add(maybe_value)
+    def _add(arg, maybe_value = None, format = None):
+        if format != None:
+            formatted = format % arg
+            run_info.append(formatted)
+            run_shell_list.append(formatted)
+            args.add(arg, format = format)
+        else:
+            run_info.append(arg)
+            run_shell_list.append(arg)
+            args.add(arg)
+            if maybe_value != None:
+                run_info.append(maybe_value)
+                run_shell_list.append(maybe_value)
+                args.add(maybe_value)
+
+    def _add_run_shell(arg, maybe_value = None, format = None):
+        if format != None:
+            formatted = format % arg
+            run_shell_list.append(formatted)
+            args.add(arg, format = format)
+        else:
+            run_shell_list.append(arg)
+            args.add(arg)
+            if maybe_value != None:
+                run_shell_list.append(maybe_value)
+                args.add(maybe_value)
 
     def _add_run_info(arg):
         if type(arg) == "list":
@@ -154,7 +165,7 @@ def _common_lock(ctx, locker):
     if project:
         rerooted_project = _reroot(project, directory)
         if rerooted_project:
-            args.add("--project", rerooted_project)
+            args.add(rerooted_project, format = "--project=%s")
 
     for arg in ctx.attr.args:
         args.add(arg)

From 26d6d99a80cc271d52c341f069352ff93bc00dec Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Thu, 27 Aug 2026 00:19:17 -0700
Subject: [PATCH 12/16] chore(uv): restore explanatory build action comments in
 uv_lock.sh

Restore comments explaining POSIX symlink and Windows copy mechanisms
for existing lock files.
---
 python/uv/private/template/uv_lock.sh | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/python/uv/private/template/uv_lock.sh b/python/uv/private/template/uv_lock.sh
index eacd69e737..10d37fd5fb 100755
--- a/python/uv/private/template/uv_lock.sh
+++ b/python/uv/private/template/uv_lock.sh
@@ -6,6 +6,21 @@ if [[ -n "${BUILD_WORKSPACE_DIRECTORY:-}" ]]; then
 fi
 
 # Build action mode
+#
+# If the uv.lock exists, remove because the existing uv.lock file is read-only,
+# then symlink so that we can reuse the existing contents and not do a full
+# relock all the time. If nothing exists, just symlink.
+#
+# On Windows we do it with file copies:
+# 1. If the file exists:
+#    1. Copy the current file to out.
+#    2. Rm the existing file
+#    3. Copy the contents back
+#    4. Run uv
+#    5. Copy the contents to out.
+# 1. If the current uv.lock does not exist yet
+#    1. Run uv
+#    2. Copy the contents to out.
 readonly out="{{out}}"
 if [[ -f "{{src_out}}" ]]; then
     cp "{{src_out}}" "$out"

From 84b261b64cd3a4bc68ce6e679cf40c8f29f603f0 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Tue, 1 Sep 2026 21:59:24 +0900
Subject: [PATCH 13/16] fix versionadded

---
 python/uv/private/lock.bzl | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 32c0dc8f8f..c02a710c15 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -624,9 +624,6 @@ def lock(
     All of the targets have `manual` tags as locking results cannot be cached.
     :::
 
-    :::{versionadded} VERSION_NEXT_FEATURE
-    :::
-
     Args:
         name: {type}`str` The prefix of all targets created by this macro.
         srcs: {type}`list[Label]` The sources that will be used. Add all of the
@@ -640,6 +637,7 @@ def lock(
         constraints: {type}`list[Label]` The list of constraints files to use.
         directory: {type}`str` The directory into which we should cd when
             running the command.
+            {versionadded} VERSION_NEXT_FEATURE
         generate_hashes: {type}`bool` Generate hashes for all of the
             requirements. Only meaningful for `requirements.txt` style output.
             Defaults to `True`.

From 3209868b1e7004fa8bd94e2543e4a7455e6cd794 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Wed, 2 Sep 2026 08:42:45 +0900
Subject: [PATCH 14/16] change: set default directory

---
 dev/BUILD.bazel                        | 2 --
 python/uv/private/lock.bzl             | 2 ++
 tests/multi_pypi/beta/requirements.txt | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/dev/BUILD.bazel b/dev/BUILD.bazel
index 77dbb7ee15..22fe5bb918 100644
--- a/dev/BUILD.bazel
+++ b/dev/BUILD.bazel
@@ -12,7 +12,6 @@ lock(
         "--universal",
         "--upgrade",
     ],
-    directory = "dev",
     # NOTE @aignas 2025-08-17: here we select the lowest actively supported
     # version so that the requirements file is generated to be compatible with
     # Python version 3.10 or greater.
@@ -25,7 +24,6 @@ lock(
     name = "uv_lock",
     srcs = ["pyproject.toml"],
     out = "uv.lock",
-    directory = "dev",
     python_version = "3.10",
     visibility = ["//:__subpackages__"],
 )
diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index c02a710c15..98b113b70f 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -700,6 +700,8 @@ def lock(
         lock_target_kwargs["build_constraints"] = build_constraints
     if constraints:
         lock_target_kwargs["constraints"] = constraints
+    if directory == None:
+        directory = native.package_directory()
     if directory:
         lock_target_kwargs["directory"] = directory
 
diff --git a/tests/multi_pypi/beta/requirements.txt b/tests/multi_pypi/beta/requirements.txt
index de05f6dc9a..d4c93c2cfa 100644
--- a/tests/multi_pypi/beta/requirements.txt
+++ b/tests/multi_pypi/beta/requirements.txt
@@ -3,4 +3,4 @@
 more-itertools==9.0.0 \
     --hash=sha256:250e83d7e81d0c87ca6bd942e6aeab8cc9daa6096d12c5308f3f92fa5e5c1f41 \
     --hash=sha256:5a6257e40878ef0520b1803990e3e22303a41b5714006c32a3fd8304b26ea1ab
-    # via multi-pypi-test-beta (tests/multi_pypi/beta/pyproject.toml)
+    # via multi-pypi-test-beta (pyproject.toml)

From 36372438fd695bc542c7e334a81bbde7883883c1 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Wed, 2 Sep 2026 09:12:15 +0900
Subject: [PATCH 15/16] add all of the locking targets to a single private
 target

---
 dev/requirements.txt                          |  44 ++---
 examples/BUILD.bazel                          |  12 ++
 examples/bzlmod/requirements_lock_3_12.txt    |  24 +--
 examples/bzlmod/requirements_lock_3_13.txt    |  24 +--
 examples/bzlmod/requirements_lock_3_14.txt    |  24 +--
 examples/bzlmod/requirements_windows_3_12.txt |  24 +--
 examples/bzlmod/requirements_windows_3_13.txt |  24 +--
 examples/bzlmod/requirements_windows_3_14.txt |  24 +--
 private/BUILD.bazel                           |  11 ++
 python/uv/private/lock.bzl                    |  13 +-
 tests/multi_pypi/alpha/BUILD.bazel            |   1 +
 tests/multi_pypi/alpha/requirements.txt       |   2 +-
 tests/multi_pypi/beta/BUILD.bazel             |   1 +
 tests/uv/lock/pyproject_toml/BUILD.bazel      |   2 +
 tests/uv/lock/pyproject_toml/requirements.txt |  10 +-
 tests/uv/lock/workspaces/BUILD.bazel          |   1 +
 tests/uv/lock/workspaces/requirements.txt     |   4 +-
 tools/publish/requirements_darwin.txt         |  70 ++++----
 tools/publish/requirements_linux.txt          | 164 +++++++++---------
 tools/publish/requirements_universal.txt      | 164 +++++++++---------
 tools/publish/requirements_windows.txt        |  70 ++++----
 21 files changed, 367 insertions(+), 346 deletions(-)

diff --git a/dev/requirements.txt b/dev/requirements.txt
index af120d1f88..d0415efc18 100644
--- a/dev/requirements.txt
+++ b/dev/requirements.txt
@@ -5,7 +5,7 @@
 absl-py==2.5.0 \
     --hash=sha256:0c996f25c0490700fadabe6351630f6111534fa0ae252cc6d2014ea3b141135f \
     --hash=sha256:0f17b89f2a4eaaedc4f28c622998aa690564b3012a396a4ffad0821007fe03ba
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 alabaster==1.0.0 \
     --hash=sha256:c00dca57bca26fa62a6d7d0a9fcce65f3e026e9bfe33e9c538fd3fbb2144fd9e \
     --hash=sha256:fc6786402dc3fcb2de3cabd5fe455a2db534b371124f1f21de8731783dec828b
@@ -228,9 +228,9 @@ idna==3.19 \
     --hash=sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15 \
     --hash=sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4
     # via requests
-imagesize==2.0.0 \
-    --hash=sha256:5667c5bbb57ab3f1fa4bc366f4fbc971db3d5ed011fd2715fd8001f782718d96 \
-    --hash=sha256:8e8358c4a05c304f1fccf7ff96f036e7243a189e9e42e90851993c558cfe9ee3
+imagesize==2.0.1 \
+    --hash=sha256:b2ba6a4dea487a7ebcd53248d3476aca449d30db12a2dde5e0c5ca9624fd77e5 \
+    --hash=sha256:ea0c9a0384df69ed86a943a15cde37d0360b82491b3910dc2215e202e62b5b02
     # via sphinx
 iniconfig==2.3.0 \
     --hash=sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730 \
@@ -246,7 +246,7 @@ jinja2==3.1.6 \
 macholib==1.16.4 \
     --hash=sha256:da1a3fa8266e30f0ce7e97c6a54eefaae8edd1e5f86f3eb8b95457cae90265ea \
     --hash=sha256:f408c93ab2e995cd2c46e34fe328b130404be143469e41bc366c807448979362
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 markdown-it-py==3.0.0 ; python_full_version < '3.11' \
     --hash=sha256:355216845c60bd96232cd8d8c40e8f9765cc86f46880e43a8fd22dc1a1a8cab1 \
     --hash=sha256:e3f60a94fa066dc52ec76661e37c851cb232d92f9886b15cb560aaada2df8feb
@@ -350,7 +350,7 @@ markupsafe==3.0.3 \
     --hash=sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a \
     --hash=sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   jinja2
 mdit-py-plugins==0.6.1 \
     --hash=sha256:214c82fb2ac524472ab6a5bcab1de80f73b50443e187f401bfd77efbc7c6481d \
@@ -363,11 +363,11 @@ mdurl==0.1.2 \
 myst-parser==4.0.1 ; python_full_version < '3.11' \
     --hash=sha256:5cfea715e4f3574138aecbf7d54132296bfd72bb614d31168f48c477a830a7c4 \
     --hash=sha256:9134e88959ec3b5780aedf8a99680ea242869d012e8821db3126d427edc9c95d
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 myst-parser==5.1.0 ; python_full_version >= '3.11' \
     --hash=sha256:9c91c52b3cdb4d94a6506e4fab4e2f296c7623a0da0dcbe6de1565c3dad67a8a \
     --hash=sha256:ab69322dc6719dcc7f296479dbb70181b66df6ed315064f92dbc85c0e1bf2f02
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 packaging==26.3 \
     --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
     --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
@@ -378,7 +378,7 @@ packaging==26.3 \
 pefile==2024.8.26 \
     --hash=sha256:3ff6c5d8b43e8c37bb6e6dd5085658d658a7a0bdcd20b6a07b1fcfc1c4e9d632 \
     --hash=sha256:76f8b485dcd3b1bb8166f1128d395fa3d87af26360c2358fb75b80019b957c6f
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pluggy==1.6.0 \
     --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
     --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
@@ -386,7 +386,7 @@ pluggy==1.6.0 \
 pyelftools==0.33 \
     --hash=sha256:660d82dcbeb8e83d1702bd97f223f761625da06111c0cc988eac6b8ab0c1b61f \
     --hash=sha256:f215ad5f47d3f1373a21496a6c9e0707c622840d0622f23ff7ce08678b020036
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pygments==2.21.0 \
     --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \
     --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c
@@ -397,16 +397,16 @@ pytest==9.1.1 \
     --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \
     --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   pytest-bazel
     #   pytest-mock
 pytest-bazel==0.1.6 \
     --hash=sha256:a29e80e1d67c3db801bdd4d0b6b742f2bfb48cd6841caa33401458e5c4e29c21
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pytest-mock==3.15.1 \
     --hash=sha256:0a25e2eb88fe5168d535041d09a4529a188176ae608a6d249ee65abc0949630d \
     --hash=sha256:1849a238f6f396da19762269de72cb1814ab44416fa73a8686deac10b0d87a0f
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 pyyaml==6.0.3 \
     --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
     --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -485,7 +485,7 @@ pyyaml==6.0.3 \
 readthedocs-sphinx-ext==2.2.5 \
     --hash=sha256:ee5fd5b99db9f0c180b2396cbce528aa36671951b9526bb0272dbfce5517bd27 \
     --hash=sha256:f8c56184ea011c972dd45a90122568587cc85b0127bc9cf064d17c68bc809daa
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
@@ -504,7 +504,7 @@ sphinx==8.1.3 ; python_full_version < '3.11' \
     --hash=sha256:09719015511837b76bf6e03e42eb7595ac8c2e41eeb9c29c5b755c6b677992a2 \
     --hash=sha256:43c1911eecb0d3e161ad78611bc905d1ad0e523e4ddc202a58a821773dc4c927
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   myst-parser
     #   sphinx-reredirects
     #   sphinx-rtd-theme
@@ -513,7 +513,7 @@ sphinx==9.0.4 ; python_full_version == '3.11.*' \
     --hash=sha256:594ef59d042972abbc581d8baa577404abe4e6c3b04ef61bd7fc2acbd51f3fa3 \
     --hash=sha256:5bebc595a5e943ea248b99c13814c1c5e10b3ece718976824ffa7959ff95fffb
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   myst-parser
     #   sphinx-reredirects
     #   sphinx-rtd-theme
@@ -522,7 +522,7 @@ sphinx==9.1.0 ; python_full_version >= '3.12' \
     --hash=sha256:7741722357dd75f8190766926071fed3bdc211c74dd2d7d4df5404da95930ddb \
     --hash=sha256:c84fdd4e782504495fe4f2c0b3413d6c2bf388589bb352d439b2a3bb99991978
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   myst-parser
     #   sphinx-reredirects
     #   sphinx-rtd-theme
@@ -530,19 +530,19 @@ sphinx==9.1.0 ; python_full_version >= '3.12' \
 sphinx-autodoc2==0.5.0 \
     --hash=sha256:7d76044aa81d6af74447080182b6868c7eb066874edc835e8ddf810735b6565a \
     --hash=sha256:e867013b1512f9d6d7e6f6799f8b537d6884462acd118ef361f3f619a60b5c9e
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 sphinx-reredirects==0.1.6 ; python_full_version < '3.11' \
     --hash=sha256:c491cba545f67be9697508727818d8626626366245ae64456fe29f37e9bbea64 \
     --hash=sha256:efd50c766fbc5bf40cd5148e10c00f2c00d143027de5c5e48beece93cc40eeea
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 sphinx-reredirects==1.1.0 ; python_full_version >= '3.11' \
     --hash=sha256:4b5692273c72cd2d4d917f4c6f87d5919e4d6114a752d4be033f7f5f6310efd9 \
     --hash=sha256:fb9b195335ab14b43f8273287d0c7eeb637ba6c56c66581c11b47202f6718b29
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 sphinx-rtd-theme==3.1.0 \
     --hash=sha256:1785824ae8e6632060490f67cf3a72d404a85d2d9fc26bce3619944de5682b89 \
     --hash=sha256:b44276f2c276e909239a4f6c955aa667aaafeb78597923b1c60babc76db78e4c
-    # via rules-python-dev (dev/pyproject.toml)
+    # via rules-python-dev (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0 \
     --hash=sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1 \
     --hash=sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5
@@ -627,7 +627,7 @@ typing-extensions==4.16.0 \
     --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
     --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
     # via
-    #   rules-python-dev (dev/pyproject.toml)
+    #   rules-python-dev (pyproject.toml)
     #   astroid
     #   exceptiongroup
     #   sphinx-autodoc2
diff --git a/examples/BUILD.bazel b/examples/BUILD.bazel
index 06e63bc0e6..075617a9c4 100644
--- a/examples/BUILD.bazel
+++ b/examples/BUILD.bazel
@@ -26,7 +26,9 @@ lock(
         "--universal",
         "--python-version=3.12",
     ],
+    directory = "examples/bzlmod",
     python_version = "3.12",
+    visibility = ["//:__subpackages__"],
 )
 
 lock(
@@ -39,7 +41,9 @@ lock(
         "windows",
         "--python-version=3.12",
     ],
+    directory = "examples/bzlmod",
     python_version = "3.12",
+    visibility = ["//:__subpackages__"],
 )
 
 lock(
@@ -51,7 +55,9 @@ lock(
         "--universal",
         "--python-version=3.13",
     ],
+    directory = "examples/bzlmod",
     python_version = "3.13",
+    visibility = ["//:__subpackages__"],
 )
 
 lock(
@@ -64,7 +70,9 @@ lock(
         "windows",
         "--python-version=3.13",
     ],
+    directory = "examples/bzlmod",
     python_version = "3.13",
+    visibility = ["//:__subpackages__"],
 )
 
 lock(
@@ -76,7 +84,9 @@ lock(
         "--universal",
         "--python-version=3.14",
     ],
+    directory = "examples/bzlmod",
     python_version = "3.14",
+    visibility = ["//:__subpackages__"],
 )
 
 lock(
@@ -89,5 +99,7 @@ lock(
         "windows",
         "--python-version=3.14",
     ],
+    directory = "examples/bzlmod",
     python_version = "3.14",
+    visibility = ["//:__subpackages__"],
 )
diff --git a/examples/bzlmod/requirements_lock_3_12.txt b/examples/bzlmod/requirements_lock_3_12.txt
index 1b145ee57b..a57d925eed 100644
--- a/examples/bzlmod/requirements_lock_3_12.txt
+++ b/examples/bzlmod/requirements_lock_3_12.txt
@@ -196,7 +196,7 @@ colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint
     #   sphinx
 dill==0.4.1 \
@@ -386,17 +386,17 @@ pylint==2.17.7 \
     --hash=sha256:27a8d4c7ddc8c2f8c18aa0050148f89ffc09838142193fdbe98f172781a3ff87 \
     --hash=sha256:f4fcac7ae74cfe36bc8451e931d8438e4a476c20314b1101c458ad0f05191fad
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint-print
 pylint-print==1.0.1 \
     --hash=sha256:30aa207e9718ebf4ceb47fb87012092e6d8743aab932aa07aa14a73e750ad3d0 \
     --hash=sha256:a2b2599e7887b93e551db2624c523c1e6e9e58c3be8416cd98d41e4427e2669b
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   s3cmd
 python-magic==0.4.27 \
     --hash=sha256:c1ba14b08e4a5f5c31a302b7721239695b2f0f058d125bd5ce1ee36b9d9d3c3b \
@@ -481,12 +481,12 @@ requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 s3cmd==2.1.0 \
     --hash=sha256:49cd23d516b17974b22b611a95ce4d93fe326feaa07320bd1d234fed68cbccfa \
     --hash=sha256:966b0a494a916fc3b4324de38f089c86c70ee90e8e1cae6d59102103a4c0cc03
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 six==1.17.0 \
     --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
     --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
@@ -498,7 +498,7 @@ snowballstemmer==3.1.1 \
 sphinx==7.3.7 \
     --hash=sha256:413f75440be4cacf328f580b4274ada4565fb2187d696a84970c23f77b64d8c3 \
     --hash=sha256:a4a7db75ed37531c05002d56ed6948d4c42f473a36f46e1382b0bd76ca9627bc
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0 \
     --hash=sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1 \
     --hash=sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5
@@ -523,12 +523,12 @@ sphinxcontrib-serializinghtml==2.0.0 \
     --hash=sha256:6e2cb0eef194e10c27ec0023bfeb25badbbb5868244cf5bc5bdc04e4464bf331 \
     --hash=sha256:e9d912827f872c029017a53f0ef2180b327c3f7fd23c87229f7a8e8b70031d4d
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 tabulate==0.9.0 \
     --hash=sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c \
     --hash=sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 tomlkit==0.15.1 \
     --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
     --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
@@ -646,11 +646,11 @@ websockets==17.0.1 \
     --hash=sha256:f47b0815af3948ec6a440b3afa02f05b18cc0939549e91b5c677b5d9c2c8472a \
     --hash=sha256:f991247276797d0c61ab7770bc9791eadc16f683b4d83517f624932adc1a8bab \
     --hash=sha256:ffad64ce7ad3703d652a3fd9af26238377d24ce52c6ad8ff35d26d82f61f493f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wheel==0.46.2 \
     --hash=sha256:33ae60725d69eaa249bc1982e739943c23b34b58d51f1cb6253453773aca6e65 \
     --hash=sha256:3d79e48fde9847618a5a181f3cc35764c349c752e2fe911e65fa17faab9809b0
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wrapt==1.17.3 \
     --hash=sha256:02b551d101f31694fc785e58e0720ef7d9a10c4e62c1c9358ce6f63f23e30a56 \
     --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828 \
@@ -737,4 +737,4 @@ wrapt==1.17.3 \
 yamllint==1.38.0 \
     --hash=sha256:09e5f29531daab93366bb061e76019d5e91691ef0a40328f04c927387d1d364d \
     --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
diff --git a/examples/bzlmod/requirements_lock_3_13.txt b/examples/bzlmod/requirements_lock_3_13.txt
index 1a4710df51..0401d84cb6 100644
--- a/examples/bzlmod/requirements_lock_3_13.txt
+++ b/examples/bzlmod/requirements_lock_3_13.txt
@@ -196,7 +196,7 @@ colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint
     #   sphinx
 dill==0.4.1 \
@@ -386,17 +386,17 @@ pylint==2.17.7 \
     --hash=sha256:27a8d4c7ddc8c2f8c18aa0050148f89ffc09838142193fdbe98f172781a3ff87 \
     --hash=sha256:f4fcac7ae74cfe36bc8451e931d8438e4a476c20314b1101c458ad0f05191fad
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint-print
 pylint-print==1.0.1 \
     --hash=sha256:30aa207e9718ebf4ceb47fb87012092e6d8743aab932aa07aa14a73e750ad3d0 \
     --hash=sha256:a2b2599e7887b93e551db2624c523c1e6e9e58c3be8416cd98d41e4427e2669b
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   s3cmd
 python-magic==0.4.27 \
     --hash=sha256:c1ba14b08e4a5f5c31a302b7721239695b2f0f058d125bd5ce1ee36b9d9d3c3b \
@@ -481,12 +481,12 @@ requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 s3cmd==2.1.0 \
     --hash=sha256:49cd23d516b17974b22b611a95ce4d93fe326feaa07320bd1d234fed68cbccfa \
     --hash=sha256:966b0a494a916fc3b4324de38f089c86c70ee90e8e1cae6d59102103a4c0cc03
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 six==1.17.0 \
     --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
     --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
@@ -498,7 +498,7 @@ snowballstemmer==3.1.1 \
 sphinx==7.3.7 \
     --hash=sha256:413f75440be4cacf328f580b4274ada4565fb2187d696a84970c23f77b64d8c3 \
     --hash=sha256:a4a7db75ed37531c05002d56ed6948d4c42f473a36f46e1382b0bd76ca9627bc
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0 \
     --hash=sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1 \
     --hash=sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5
@@ -523,12 +523,12 @@ sphinxcontrib-serializinghtml==2.0.0 \
     --hash=sha256:6e2cb0eef194e10c27ec0023bfeb25badbbb5868244cf5bc5bdc04e4464bf331 \
     --hash=sha256:e9d912827f872c029017a53f0ef2180b327c3f7fd23c87229f7a8e8b70031d4d
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 tabulate==0.9.0 \
     --hash=sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c \
     --hash=sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 tomlkit==0.15.1 \
     --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
     --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
@@ -646,11 +646,11 @@ websockets==17.0.1 \
     --hash=sha256:f47b0815af3948ec6a440b3afa02f05b18cc0939549e91b5c677b5d9c2c8472a \
     --hash=sha256:f991247276797d0c61ab7770bc9791eadc16f683b4d83517f624932adc1a8bab \
     --hash=sha256:ffad64ce7ad3703d652a3fd9af26238377d24ce52c6ad8ff35d26d82f61f493f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wheel==0.46.2 \
     --hash=sha256:33ae60725d69eaa249bc1982e739943c23b34b58d51f1cb6253453773aca6e65 \
     --hash=sha256:3d79e48fde9847618a5a181f3cc35764c349c752e2fe911e65fa17faab9809b0
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wrapt==1.17.3 \
     --hash=sha256:02b551d101f31694fc785e58e0720ef7d9a10c4e62c1c9358ce6f63f23e30a56 \
     --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828 \
@@ -737,4 +737,4 @@ wrapt==1.17.3 \
 yamllint==1.38.0 \
     --hash=sha256:09e5f29531daab93366bb061e76019d5e91691ef0a40328f04c927387d1d364d \
     --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
diff --git a/examples/bzlmod/requirements_lock_3_14.txt b/examples/bzlmod/requirements_lock_3_14.txt
index dee788085c..bc70f5e29a 100644
--- a/examples/bzlmod/requirements_lock_3_14.txt
+++ b/examples/bzlmod/requirements_lock_3_14.txt
@@ -196,7 +196,7 @@ colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint
     #   sphinx
 dill==0.4.1 \
@@ -386,17 +386,17 @@ pylint==2.17.7 \
     --hash=sha256:27a8d4c7ddc8c2f8c18aa0050148f89ffc09838142193fdbe98f172781a3ff87 \
     --hash=sha256:f4fcac7ae74cfe36bc8451e931d8438e4a476c20314b1101c458ad0f05191fad
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint-print
 pylint-print==1.0.1 \
     --hash=sha256:30aa207e9718ebf4ceb47fb87012092e6d8743aab932aa07aa14a73e750ad3d0 \
     --hash=sha256:a2b2599e7887b93e551db2624c523c1e6e9e58c3be8416cd98d41e4427e2669b
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   s3cmd
 python-magic==0.4.27 \
     --hash=sha256:c1ba14b08e4a5f5c31a302b7721239695b2f0f058d125bd5ce1ee36b9d9d3c3b \
@@ -481,12 +481,12 @@ requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 s3cmd==2.1.0 \
     --hash=sha256:49cd23d516b17974b22b611a95ce4d93fe326feaa07320bd1d234fed68cbccfa \
     --hash=sha256:966b0a494a916fc3b4324de38f089c86c70ee90e8e1cae6d59102103a4c0cc03
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 six==1.17.0 \
     --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
     --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
@@ -498,7 +498,7 @@ snowballstemmer==3.1.1 \
 sphinx==7.3.7 \
     --hash=sha256:413f75440be4cacf328f580b4274ada4565fb2187d696a84970c23f77b64d8c3 \
     --hash=sha256:a4a7db75ed37531c05002d56ed6948d4c42f473a36f46e1382b0bd76ca9627bc
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0 \
     --hash=sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1 \
     --hash=sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5
@@ -523,12 +523,12 @@ sphinxcontrib-serializinghtml==2.0.0 \
     --hash=sha256:6e2cb0eef194e10c27ec0023bfeb25badbbb5868244cf5bc5bdc04e4464bf331 \
     --hash=sha256:e9d912827f872c029017a53f0ef2180b327c3f7fd23c87229f7a8e8b70031d4d
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 tabulate==0.9.0 \
     --hash=sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c \
     --hash=sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 tomlkit==0.15.1 \
     --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
     --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
@@ -646,11 +646,11 @@ websockets==17.0.1 \
     --hash=sha256:f47b0815af3948ec6a440b3afa02f05b18cc0939549e91b5c677b5d9c2c8472a \
     --hash=sha256:f991247276797d0c61ab7770bc9791eadc16f683b4d83517f624932adc1a8bab \
     --hash=sha256:ffad64ce7ad3703d652a3fd9af26238377d24ce52c6ad8ff35d26d82f61f493f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wheel==0.46.2 \
     --hash=sha256:33ae60725d69eaa249bc1982e739943c23b34b58d51f1cb6253453773aca6e65 \
     --hash=sha256:3d79e48fde9847618a5a181f3cc35764c349c752e2fe911e65fa17faab9809b0
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wrapt==1.17.3 \
     --hash=sha256:02b551d101f31694fc785e58e0720ef7d9a10c4e62c1c9358ce6f63f23e30a56 \
     --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828 \
@@ -737,4 +737,4 @@ wrapt==1.17.3 \
 yamllint==1.38.0 \
     --hash=sha256:09e5f29531daab93366bb061e76019d5e91691ef0a40328f04c927387d1d364d \
     --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
diff --git a/examples/bzlmod/requirements_windows_3_12.txt b/examples/bzlmod/requirements_windows_3_12.txt
index dca599b624..31c4730166 100644
--- a/examples/bzlmod/requirements_windows_3_12.txt
+++ b/examples/bzlmod/requirements_windows_3_12.txt
@@ -196,7 +196,7 @@ colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint
     #   sphinx
 dill==0.4.1 \
@@ -386,17 +386,17 @@ pylint==2.17.7 \
     --hash=sha256:27a8d4c7ddc8c2f8c18aa0050148f89ffc09838142193fdbe98f172781a3ff87 \
     --hash=sha256:f4fcac7ae74cfe36bc8451e931d8438e4a476c20314b1101c458ad0f05191fad
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint-print
 pylint-print==1.0.1 \
     --hash=sha256:30aa207e9718ebf4ceb47fb87012092e6d8743aab932aa07aa14a73e750ad3d0 \
     --hash=sha256:a2b2599e7887b93e551db2624c523c1e6e9e58c3be8416cd98d41e4427e2669b
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   s3cmd
 python-magic==0.4.27 \
     --hash=sha256:c1ba14b08e4a5f5c31a302b7721239695b2f0f058d125bd5ce1ee36b9d9d3c3b \
@@ -481,12 +481,12 @@ requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 s3cmd==2.1.0 \
     --hash=sha256:49cd23d516b17974b22b611a95ce4d93fe326feaa07320bd1d234fed68cbccfa \
     --hash=sha256:966b0a494a916fc3b4324de38f089c86c70ee90e8e1cae6d59102103a4c0cc03
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 six==1.17.0 \
     --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
     --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
@@ -498,7 +498,7 @@ snowballstemmer==3.1.1 \
 sphinx==7.3.7 \
     --hash=sha256:413f75440be4cacf328f580b4274ada4565fb2187d696a84970c23f77b64d8c3 \
     --hash=sha256:a4a7db75ed37531c05002d56ed6948d4c42f473a36f46e1382b0bd76ca9627bc
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0 \
     --hash=sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1 \
     --hash=sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5
@@ -523,12 +523,12 @@ sphinxcontrib-serializinghtml==2.0.0 \
     --hash=sha256:6e2cb0eef194e10c27ec0023bfeb25badbbb5868244cf5bc5bdc04e4464bf331 \
     --hash=sha256:e9d912827f872c029017a53f0ef2180b327c3f7fd23c87229f7a8e8b70031d4d
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 tabulate==0.9.0 \
     --hash=sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c \
     --hash=sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 tomlkit==0.15.1 \
     --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
     --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
@@ -646,11 +646,11 @@ websockets==17.0.1 \
     --hash=sha256:f47b0815af3948ec6a440b3afa02f05b18cc0939549e91b5c677b5d9c2c8472a \
     --hash=sha256:f991247276797d0c61ab7770bc9791eadc16f683b4d83517f624932adc1a8bab \
     --hash=sha256:ffad64ce7ad3703d652a3fd9af26238377d24ce52c6ad8ff35d26d82f61f493f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wheel==0.46.2 \
     --hash=sha256:33ae60725d69eaa249bc1982e739943c23b34b58d51f1cb6253453773aca6e65 \
     --hash=sha256:3d79e48fde9847618a5a181f3cc35764c349c752e2fe911e65fa17faab9809b0
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wrapt==1.17.3 \
     --hash=sha256:02b551d101f31694fc785e58e0720ef7d9a10c4e62c1c9358ce6f63f23e30a56 \
     --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828 \
@@ -737,4 +737,4 @@ wrapt==1.17.3 \
 yamllint==1.38.0 \
     --hash=sha256:09e5f29531daab93366bb061e76019d5e91691ef0a40328f04c927387d1d364d \
     --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
diff --git a/examples/bzlmod/requirements_windows_3_13.txt b/examples/bzlmod/requirements_windows_3_13.txt
index 192b14e3d2..2618c52ad9 100644
--- a/examples/bzlmod/requirements_windows_3_13.txt
+++ b/examples/bzlmod/requirements_windows_3_13.txt
@@ -196,7 +196,7 @@ colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint
     #   sphinx
 dill==0.4.1 \
@@ -386,17 +386,17 @@ pylint==2.17.7 \
     --hash=sha256:27a8d4c7ddc8c2f8c18aa0050148f89ffc09838142193fdbe98f172781a3ff87 \
     --hash=sha256:f4fcac7ae74cfe36bc8451e931d8438e4a476c20314b1101c458ad0f05191fad
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint-print
 pylint-print==1.0.1 \
     --hash=sha256:30aa207e9718ebf4ceb47fb87012092e6d8743aab932aa07aa14a73e750ad3d0 \
     --hash=sha256:a2b2599e7887b93e551db2624c523c1e6e9e58c3be8416cd98d41e4427e2669b
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   s3cmd
 python-magic==0.4.27 \
     --hash=sha256:c1ba14b08e4a5f5c31a302b7721239695b2f0f058d125bd5ce1ee36b9d9d3c3b \
@@ -481,12 +481,12 @@ requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 s3cmd==2.1.0 \
     --hash=sha256:49cd23d516b17974b22b611a95ce4d93fe326feaa07320bd1d234fed68cbccfa \
     --hash=sha256:966b0a494a916fc3b4324de38f089c86c70ee90e8e1cae6d59102103a4c0cc03
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 six==1.17.0 \
     --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
     --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
@@ -498,7 +498,7 @@ snowballstemmer==3.1.1 \
 sphinx==7.3.7 \
     --hash=sha256:413f75440be4cacf328f580b4274ada4565fb2187d696a84970c23f77b64d8c3 \
     --hash=sha256:a4a7db75ed37531c05002d56ed6948d4c42f473a36f46e1382b0bd76ca9627bc
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0 \
     --hash=sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1 \
     --hash=sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5
@@ -523,12 +523,12 @@ sphinxcontrib-serializinghtml==2.0.0 \
     --hash=sha256:6e2cb0eef194e10c27ec0023bfeb25badbbb5868244cf5bc5bdc04e4464bf331 \
     --hash=sha256:e9d912827f872c029017a53f0ef2180b327c3f7fd23c87229f7a8e8b70031d4d
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 tabulate==0.9.0 \
     --hash=sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c \
     --hash=sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 tomlkit==0.15.1 \
     --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
     --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
@@ -646,11 +646,11 @@ websockets==17.0.1 \
     --hash=sha256:f47b0815af3948ec6a440b3afa02f05b18cc0939549e91b5c677b5d9c2c8472a \
     --hash=sha256:f991247276797d0c61ab7770bc9791eadc16f683b4d83517f624932adc1a8bab \
     --hash=sha256:ffad64ce7ad3703d652a3fd9af26238377d24ce52c6ad8ff35d26d82f61f493f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wheel==0.46.2 \
     --hash=sha256:33ae60725d69eaa249bc1982e739943c23b34b58d51f1cb6253453773aca6e65 \
     --hash=sha256:3d79e48fde9847618a5a181f3cc35764c349c752e2fe911e65fa17faab9809b0
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wrapt==1.17.3 \
     --hash=sha256:02b551d101f31694fc785e58e0720ef7d9a10c4e62c1c9358ce6f63f23e30a56 \
     --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828 \
@@ -737,4 +737,4 @@ wrapt==1.17.3 \
 yamllint==1.38.0 \
     --hash=sha256:09e5f29531daab93366bb061e76019d5e91691ef0a40328f04c927387d1d364d \
     --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
diff --git a/examples/bzlmod/requirements_windows_3_14.txt b/examples/bzlmod/requirements_windows_3_14.txt
index f25315d4ad..2af85f8a60 100644
--- a/examples/bzlmod/requirements_windows_3_14.txt
+++ b/examples/bzlmod/requirements_windows_3_14.txt
@@ -196,7 +196,7 @@ colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint
     #   sphinx
 dill==0.4.1 \
@@ -386,17 +386,17 @@ pylint==2.17.7 \
     --hash=sha256:27a8d4c7ddc8c2f8c18aa0050148f89ffc09838142193fdbe98f172781a3ff87 \
     --hash=sha256:f4fcac7ae74cfe36bc8451e931d8438e4a476c20314b1101c458ad0f05191fad
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   pylint-print
 pylint-print==1.0.1 \
     --hash=sha256:30aa207e9718ebf4ceb47fb87012092e6d8743aab932aa07aa14a73e750ad3d0 \
     --hash=sha256:a2b2599e7887b93e551db2624c523c1e6e9e58c3be8416cd98d41e4427e2669b
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   s3cmd
 python-magic==0.4.27 \
     --hash=sha256:c1ba14b08e4a5f5c31a302b7721239695b2f0f058d125bd5ce1ee36b9d9d3c3b \
@@ -481,12 +481,12 @@ requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 s3cmd==2.1.0 \
     --hash=sha256:49cd23d516b17974b22b611a95ce4d93fe326feaa07320bd1d234fed68cbccfa \
     --hash=sha256:966b0a494a916fc3b4324de38f089c86c70ee90e8e1cae6d59102103a4c0cc03
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 six==1.17.0 \
     --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
     --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
@@ -498,7 +498,7 @@ snowballstemmer==3.1.1 \
 sphinx==7.3.7 \
     --hash=sha256:413f75440be4cacf328f580b4274ada4565fb2187d696a84970c23f77b64d8c3 \
     --hash=sha256:a4a7db75ed37531c05002d56ed6948d4c42f473a36f46e1382b0bd76ca9627bc
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0 \
     --hash=sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1 \
     --hash=sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5
@@ -523,12 +523,12 @@ sphinxcontrib-serializinghtml==2.0.0 \
     --hash=sha256:6e2cb0eef194e10c27ec0023bfeb25badbbb5868244cf5bc5bdc04e4464bf331 \
     --hash=sha256:e9d912827f872c029017a53f0ef2180b327c3f7fd23c87229f7a8e8b70031d4d
     # via
-    #   example-bzlmod (examples/bzlmod/pyproject.toml)
+    #   example-bzlmod (pyproject.toml)
     #   sphinx
 tabulate==0.9.0 \
     --hash=sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c \
     --hash=sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 tomlkit==0.15.1 \
     --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
     --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
@@ -646,11 +646,11 @@ websockets==17.0.1 \
     --hash=sha256:f47b0815af3948ec6a440b3afa02f05b18cc0939549e91b5c677b5d9c2c8472a \
     --hash=sha256:f991247276797d0c61ab7770bc9791eadc16f683b4d83517f624932adc1a8bab \
     --hash=sha256:ffad64ce7ad3703d652a3fd9af26238377d24ce52c6ad8ff35d26d82f61f493f
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wheel==0.46.2 \
     --hash=sha256:33ae60725d69eaa249bc1982e739943c23b34b58d51f1cb6253453773aca6e65 \
     --hash=sha256:3d79e48fde9847618a5a181f3cc35764c349c752e2fe911e65fa17faab9809b0
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
 wrapt==1.17.3 \
     --hash=sha256:02b551d101f31694fc785e58e0720ef7d9a10c4e62c1c9358ce6f63f23e30a56 \
     --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828 \
@@ -737,4 +737,4 @@ wrapt==1.17.3 \
 yamllint==1.38.0 \
     --hash=sha256:09e5f29531daab93366bb061e76019d5e91691ef0a40328f04c927387d1d364d \
     --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220
-    # via example-bzlmod (examples/bzlmod/pyproject.toml)
+    # via example-bzlmod (pyproject.toml)
diff --git a/private/BUILD.bazel b/private/BUILD.bazel
index 951e12f5f8..761298fbd4 100644
--- a/private/BUILD.bazel
+++ b/private/BUILD.bazel
@@ -14,6 +14,17 @@ multirun(
         ]
     ] + [
         "//dev:requirements.update",
+        "//dev:uv_lock.update",
+        "//examples:bzlmod_requirements_3_12.update",
+        "//examples:bzlmod_requirements_3_12_windows.update",
+        "//examples:bzlmod_requirements_3_13.update",
+        "//examples:bzlmod_requirements_3_13_windows.update",
+        "//examples:bzlmod_requirements_3_14.update",
+        "//examples:bzlmod_requirements_3_14_windows.update",
+        "//tests/multi_pypi/alpha:requirements.update",
+        "//tests/multi_pypi/beta:requirements.update",
+        "//tests/uv/lock/pyproject_toml:requirements.update",
+        "//tests/uv/lock/workspaces:requirements.update",
     ],
     tags = ["manual"],
 )
diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 98b113b70f..61af2d5163 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -15,6 +15,7 @@
 """An implementation for a simple macro to lock the requirements.
 """
 
+load("@bazel_skylib//lib:paths.bzl", "paths")
 load("@bazel_skylib//lib:shell.bzl", "shell")
 load("//python:py_binary.bzl", "py_binary")
 load("//python/private:bzlmod_enabled.bzl", "BZLMOD_ENABLED")  # buildifier: disable=bzl-visibility
@@ -88,16 +89,8 @@ def _reroot(x, directory):
 
     if hasattr(x, "path"):
         x = x.path
-    if x == directory:
-        return "."
 
-    if x.startswith(directory + "/"):
-        return x[len(directory) + 1:]
-
-    fail("File '{}' does not start with directory prefix '{}'".format(
-        x,
-        directory,
-    ))
+    return paths.relativize(x, directory)
 
 def _reroot_all(xs, directory):
     return [
@@ -701,7 +694,7 @@ def lock(
     if constraints:
         lock_target_kwargs["constraints"] = constraints
     if directory == None:
-        directory = native.package_directory()
+        directory = native.package_name()
     if directory:
         lock_target_kwargs["directory"] = directory
 
diff --git a/tests/multi_pypi/alpha/BUILD.bazel b/tests/multi_pypi/alpha/BUILD.bazel
index 7b56e0a547..15bb67645c 100644
--- a/tests/multi_pypi/alpha/BUILD.bazel
+++ b/tests/multi_pypi/alpha/BUILD.bazel
@@ -4,4 +4,5 @@ lock(
     name = "requirements",
     srcs = ["pyproject.toml"],
     out = "requirements.txt",
+    visibility = ["//:__subpackages__"],
 )
diff --git a/tests/multi_pypi/alpha/requirements.txt b/tests/multi_pypi/alpha/requirements.txt
index febb6b72ae..35c2015574 100644
--- a/tests/multi_pypi/alpha/requirements.txt
+++ b/tests/multi_pypi/alpha/requirements.txt
@@ -3,4 +3,4 @@
 more-itertools==9.1.0 \
     --hash=sha256:cabaa341ad0389ea83c17a94566a53ae4c9d07349861ecb14dc6d0345cf9ac5d \
     --hash=sha256:d2bc7f02446e86a68911e58ded76d6561eea00cddfb2a91e7019bbb586c799f3
-    # via multi-pypi-test-alpha (tests/multi_pypi/alpha/pyproject.toml)
+    # via multi-pypi-test-alpha (pyproject.toml)
diff --git a/tests/multi_pypi/beta/BUILD.bazel b/tests/multi_pypi/beta/BUILD.bazel
index 7b56e0a547..15bb67645c 100644
--- a/tests/multi_pypi/beta/BUILD.bazel
+++ b/tests/multi_pypi/beta/BUILD.bazel
@@ -4,4 +4,5 @@ lock(
     name = "requirements",
     srcs = ["pyproject.toml"],
     out = "requirements.txt",
+    visibility = ["//:__subpackages__"],
 )
diff --git a/tests/uv/lock/pyproject_toml/BUILD.bazel b/tests/uv/lock/pyproject_toml/BUILD.bazel
index d73d206293..c267b0f73a 100644
--- a/tests/uv/lock/pyproject_toml/BUILD.bazel
+++ b/tests/uv/lock/pyproject_toml/BUILD.bazel
@@ -17,9 +17,11 @@ lock(
         "//tests/uv/lock:testdata/constraints.txt",
         "//tests/uv/lock:testdata/constraints2.txt",
     ],
+    directory = "tests/uv/lock",
     # It seems that the CI remote executors for the RBE do not have network
     # connectivity due to current CI setup.
     tags = ["no-remote-exec"],
+    visibility = ["//:__subpackages__"],
 )
 
 diff_test(
diff --git a/tests/uv/lock/pyproject_toml/requirements.txt b/tests/uv/lock/pyproject_toml/requirements.txt
index 5e060b03d2..d2e8d931c0 100644
--- a/tests/uv/lock/pyproject_toml/requirements.txt
+++ b/tests/uv/lock/pyproject_toml/requirements.txt
@@ -4,23 +4,23 @@ certifi==2025.1.31 \
     --hash=sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651 \
     --hash=sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
+    #   -c testdata/constraints.txt
     #   requests
 idna==3.15 \
     --hash=sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8 \
     --hash=sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
+    #   -c testdata/constraints.txt
     #   requests
 requests==2.33.0 \
     --hash=sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b \
     --hash=sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
-    #   test (tests/uv/lock/pyproject_toml/pyproject.toml)
+    #   -c testdata/constraints.txt
+    #   test (pyproject_toml/pyproject.toml)
 urllib3==2.7.0 \
     --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
     --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
+    #   -c testdata/constraints.txt
     #   requests
diff --git a/tests/uv/lock/workspaces/BUILD.bazel b/tests/uv/lock/workspaces/BUILD.bazel
index aa1fabe2e3..235663ebce 100644
--- a/tests/uv/lock/workspaces/BUILD.bazel
+++ b/tests/uv/lock/workspaces/BUILD.bazel
@@ -16,6 +16,7 @@ lock(
     # It seems that the CI remote executors for the RBE do not have network
     # connectivity due to current CI setup.
     tags = ["no-remote-exec"],
+    visibility = ["//:__subpackages__"],
 )
 
 diff_test(
diff --git a/tests/uv/lock/workspaces/requirements.txt b/tests/uv/lock/workspaces/requirements.txt
index befcd69436..fdf9e9f8f6 100644
--- a/tests/uv/lock/workspaces/requirements.txt
+++ b/tests/uv/lock/workspaces/requirements.txt
@@ -28,7 +28,7 @@ black==26.5.1 \
     --hash=sha256:ea8d16dc41655aa113cd64665e7219446cd7e4ff2248d7178eaa905190c86b18 \
     --hash=sha256:ecb3e624844c798144e9bd986954e0adc81d8911a1f30f375e1252fe26e8c294 \
     --hash=sha256:ed1a20af114c301a0269bf01163d51dbef72737fd65f850001e7cbe7f3c7abae
-    # via foo (tests/uv/lock/workspaces/packages/foo/pyproject.toml)
+    # via foo (packages/foo/pyproject.toml)
 certifi==2026.7.22 \
     --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
     --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
@@ -235,7 +235,7 @@ pytokens==0.4.1 \
 requests==2.33.0 \
     --hash=sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b \
     --hash=sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652
-    # via test (tests/uv/lock/workspaces/pyproject.toml)
+    # via test (pyproject.toml)
 urllib3==2.7.0 \
     --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
     --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
diff --git a/tools/publish/requirements_darwin.txt b/tools/publish/requirements_darwin.txt
index f0e8d1e10d..eb97048d1b 100644
--- a/tools/publish/requirements_darwin.txt
+++ b/tools/publish/requirements_darwin.txt
@@ -196,9 +196,9 @@ idna==3.19 \
     --hash=sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15 \
     --hash=sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4
     # via requests
-importlib-metadata==9.0.0 \
-    --hash=sha256:2d21d1cc5a017bd0559e36150c21c830ab1dc304dedd1b7ea85d20f45ef3edd7 \
-    --hash=sha256:a4f57ab599e6a2e3016d7595cfd72eb4661a5106e787a95bcc90c7105b831efc
+importlib-metadata==9.0.1 \
+    --hash=sha256:ab830580bc0ef3db61ce8fae716389e5462b67e033018bab6d8f80ef17172f99 \
+    --hash=sha256:bba5600596a7e21f3eef53281cf28d6a5195634d2f2b78ff9501a3272c6eaab0
     # via keyring
 jaraco-classes==3.4.0 \
     --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \
@@ -230,34 +230,34 @@ more-itertools==11.1.0 \
     # via
     #   jaraco-classes
     #   jaraco-functools
-nh3==0.3.6 \
-    --hash=sha256:082675ff87b9385ec430ffe6d5847ba7456cc39b73720cd4add472f9f4cffd56 \
-    --hash=sha256:2411e8c3cee81a1ddd62c2a5d50585c28aa5566d373ad1db92536b95ddb24ef2 \
-    --hash=sha256:25c733bee928530556b1db0ea46c52cf5aa686146e38e60a6fc7cb801ef91cec \
-    --hash=sha256:2f90d9a0cfdbee218994fdaaeeb5a0fde62d08f35e4eef0378ec1e2200172fd0 \
-    --hash=sha256:34d2b0d934156b87ee114f599a3ba9b8b9e17b5d79652ba3a13fa50903de965e \
-    --hash=sha256:36d06341bd501240d320f5942481ed5e6846136b666e1ba4faf802b78ebc875f \
-    --hash=sha256:43bc1ed3fa0716295fabee29ba42b2667e4a51d140b0a68e092170a765474fa6 \
-    --hash=sha256:44673b27010051ab5a5e438a86ec31bbda61d4a77d7e900af6b7be3037c1abae \
-    --hash=sha256:455469a29951edc92bc48b47ac2281c3f2609e6c4f6a047056449f8c2c23facf \
-    --hash=sha256:4713502748f564fee0633b37b3403783ce0a3af3a3d148ad91025a5bdadb7bc6 \
-    --hash=sha256:5276ef17bdba9ad8040575c74072008b13aae429436e9d0429e718bb5f90f4da \
-    --hash=sha256:597a8e843bea00b2eb5520658dc24a9bb032e7fc9e7c2c0c4cd29420220c9796 \
-    --hash=sha256:69bbb92865a693d909db3a700d3c01537533844d0948c1e9323561ce06ecda41 \
-    --hash=sha256:69f365963f63a1e9bff53bdbb3c542c7c2efed3e163c9d5d83a772a2ac468c21 \
-    --hash=sha256:82ca5bf427ad1b216b65ede1a2e2d87dc49bec417ceba0f297213107d3cd9d78 \
-    --hash=sha256:889932a97fb4abb6f95fef1914c0d269ebfb60011e67121c1163059b9449dbb4 \
-    --hash=sha256:905f877dc66dd7aea4a76e54bcb26acb5ff8216f720c0017ccf63e0e6035698e \
-    --hash=sha256:a43ebd7543555c3ac1bc353023d0794e75cb76f6f18f19c32e95441496c0cc25 \
-    --hash=sha256:d14bf7982e7a77c0c775634c29c07ce08b38a046df73e1c1f139b3e82f18a38e \
-    --hash=sha256:e196fa70c2ff2eb4de7d3df3108f8f358c1d69dff20d45b11f20a5aa227ffb6d \
-    --hash=sha256:e1b160831c9cdb06a6c79c2f9cdb11386602938f9af260d1c457a85add4f6f69 \
-    --hash=sha256:e6b7beece07525dc6e6b0fc2f104442de2ba328360ad00e50cbe2e1fd620447d \
-    --hash=sha256:edb2b4a1a27523e6cc7c417f8d21ce3d005243548b93e56b762b66b0c7f589f9 \
-    --hash=sha256:f2f14b7ae1fca99c4a66c981aac3974e7fbc1ca30a12673d223ae1df76680917 \
-    --hash=sha256:f338ac7d594c067679f1e99b4f5ec3906842979560f9d8f15d6bdfa39a353b10 \
-    --hash=sha256:f3736c9dd3d1856f80cd031715b84ca75cda2bbb1ac802c3da26bfce590838d7 \
-    --hash=sha256:f5ed5fe84aee7f39db95c214a7421bf0499fbf500fec6d86a4e29bfc37971438
+nh3==0.3.7 \
+    --hash=sha256:157ec1eb7a62f3d9a7badb8d82d89aa810e3e24e097eedfa481a25d0c8a99877 \
+    --hash=sha256:15f5fbf090f5c88d61c820e1fc1fceecb6520cca9fe85649c06b57ef9dc9ff62 \
+    --hash=sha256:18f4278ecd157d43cb35acd5aae9f35cfa79f546b4922bd86536adc0f6312102 \
+    --hash=sha256:19f288c938ec6eef1f5d2c6cab47838e71fef8097e1c1233802be5a6230ba086 \
+    --hash=sha256:4968fe8d2db97c6f047659bf46a449fd8ec377f44ebf3e0a1b96c0d3a333ae32 \
+    --hash=sha256:5ffdfcb9a686ffb12765376bcfb6b5b55728516d3c0ee317d29982381ded3df8 \
+    --hash=sha256:614dac4a4c36ad084e78447d16fe898dedd762e354a7ab9cda2984e82f67883d \
+    --hash=sha256:618e3059caf41ccdf5dcccb3fa9df4cf6e4efe23d1382a8bbfca272a8a4f8bfc \
+    --hash=sha256:6698a822132beedab80f131c08d8d0ac5a178ddeb488d02ca4b67716ecfac7af \
+    --hash=sha256:6c3aa50eb26e9228238271db9f983cbc3b006dfbfeca2d4dc34c33ddc6ac5ea5 \
+    --hash=sha256:6e4280115d44c3b278eef712a86748c1a723105cd79feec46952383117ab4e59 \
+    --hash=sha256:70f5ac8626e899a4bab0ef74ca2f5bd602f49c7b739e6e5026b4afc6d63dac42 \
+    --hash=sha256:71860d01c16f4d8c72e334e0674beb2b0899dbd0bf760de18932ef4390303848 \
+    --hash=sha256:808def0c8c07843e6e50dc84f532457bfa2cfd17417b219a5d9e7c773709331a \
+    --hash=sha256:874b7d67a067bd29a59223f6270fc30da4edd8e6d87fd219fc93bcbaa662c946 \
+    --hash=sha256:91a4dab4e94d9fc54b9f67b1adfb23e81fab7ab43f33c3b8c97be9aa38f789ba \
+    --hash=sha256:94fd6e59553fbb9ffd8ba71bbd5a54e3126ba01799a097ae30d5341d750bc6ac \
+    --hash=sha256:9b7279d43323a25225df23576af6594a16693f61431170848b8b2ac21ad4f174 \
+    --hash=sha256:bc42bb1193c1e28a1e74c2cabaca178e118a7103e8832699fef8a2b3e2496493 \
+    --hash=sha256:be53a4825585f701955cb9baf49f478f56eb81e20294329fe4bc689dd5dd81fa \
+    --hash=sha256:d56e76bd3cadb09b6b0cef364850811663734b348a25f5f587a2819c495367bd \
+    --hash=sha256:de2b2aab32ea303405debefdcfc58043d3e635fa3f67b9eb140d2b0e0c0d2563 \
+    --hash=sha256:e8fd1ab205258b29254f72db377d99e2c96aa7653ef3b015ccab0420b094b506 \
+    --hash=sha256:eae64328e46a25785535afcb6885b6f182ecaf5ee8c88f8c075422db8aacc65b \
+    --hash=sha256:f04b7d333b27f13ca439da3cf1c75c2fba34f104969f6ce4ac8e7079699c2f4a \
+    --hash=sha256:f266d3f1b3647449923a8e406524632220dd5d8b647078dfe45b885d33d10479 \
+    --hash=sha256:fd4a70efb45d5372174f718878eb7a35c12677626a63b2f103b23b833457dcac
     # via readme-renderer
 packaging==26.3 \
     --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
@@ -269,9 +269,9 @@ pygments==2.21.0 \
     # via
     #   readme-renderer
     #   rich
-readme-renderer==45.0 \
-    --hash=sha256:030a8fac74904f8fba11ad1bb6964e3f76e896dc7e5e71f16af190c9056696d1 \
-    --hash=sha256:3385ed220117104a2bceb4a9dac8c5fdf6d1f96890d7ea2a9c7174fd5c84091f
+readme-renderer==46.0 \
+    --hash=sha256:af3e964914f6310a33ff67b72a4bdd940bed8d7c3bdecd2d14f40edf284bfe90 \
+    --hash=sha256:d0dae1f74bb273b534770cb4cccb6bb78735540afdb03c2146f4e19dcd412560
     # via twine
 requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
@@ -294,7 +294,7 @@ rich==15.0.0 \
 twine==7.0.0 \
     --hash=sha256:85cdb29c518efef867360ae4acd4b0dfd61c8654a22fca08e6f8539f05022177 \
     --hash=sha256:b854164df26db268af05f49aa5c0344b10e27a494343ff05b1e0bad3b135f5a7
-    # via rules-python-publish-deps (tools/publish/pyproject.toml)
+    # via rules-python-publish-deps (pyproject.toml)
 urllib3==2.7.0 \
     --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
     --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
diff --git a/tools/publish/requirements_linux.txt b/tools/publish/requirements_linux.txt
index 8e477081b8..a9caddb0c0 100644
--- a/tools/publish/requirements_linux.txt
+++ b/tools/publish/requirements_linux.txt
@@ -286,53 +286,53 @@ charset-normalizer==3.5.1 \
     --hash=sha256:fd0a274c0e5f9a21565cd9d3dd749b61f96b7aa1e20a93aa1ba4029518f2e5c0 \
     --hash=sha256:fdb8a068947befafba9952162645dc2fecaeb400e64584829ed5e9b2fbe21a7f
     # via requests
-cryptography==50.0.0 \
-    --hash=sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03 \
-    --hash=sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7 \
-    --hash=sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437 \
-    --hash=sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987 \
-    --hash=sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025 \
-    --hash=sha256:11b74db56cdbe3cdee6e3f6982ecb70334fa10dce99ed58bf7894aaaa3b2a037 \
-    --hash=sha256:12b9c6996425c76ea6c457ace4f3073e715b8c545add07cd1a8f3a4f90691269 \
-    --hash=sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105 \
-    --hash=sha256:19736989797678c6af1e55cd49055cdbcb55d8f6b5583ac5335f933aba9101dc \
-    --hash=sha256:1b4a266766514614f8aa60416e71f2fc6e575d36e7bdc90f644fadb2f4b75b95 \
-    --hash=sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b \
-    --hash=sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47 \
-    --hash=sha256:3f5735ffe4996d28b809371756219f5354864902a3b9e7c0b9ee87041209fc9c \
-    --hash=sha256:49e7d93abdbd2990caced757e5fade25302f719c3c8fb6e6fff2dde98999fc41 \
-    --hash=sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c \
-    --hash=sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d \
-    --hash=sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7 \
-    --hash=sha256:6ba6a53445bd3cfa809ef3ef5f1589aa6ba08784a1d962bf47d0940e871dab1c \
-    --hash=sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708 \
-    --hash=sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef \
-    --hash=sha256:80b63928fa35083b33966ce1efb70e5b9607181e49dcd1c22c8c005e319f667f \
-    --hash=sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f \
-    --hash=sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a \
-    --hash=sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f \
-    --hash=sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a \
-    --hash=sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a \
-    --hash=sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e \
-    --hash=sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3 \
-    --hash=sha256:9aa87839c383bdbab6ef865787a1fb877af8dd03464c4400322726feaaadfc6d \
-    --hash=sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3 \
-    --hash=sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f \
-    --hash=sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae \
-    --hash=sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30 \
-    --hash=sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9 \
-    --hash=sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9 \
-    --hash=sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07 \
-    --hash=sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba \
-    --hash=sha256:d58c3db7cd6eed54e6c06744db55456b65ebd7492ddeae9c1e93cfca7aa857d3 \
-    --hash=sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f \
-    --hash=sha256:df2a58a472f332225671c35b0a830208b86d004f82baa8530fa3782c85646533 \
-    --hash=sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5 \
-    --hash=sha256:ecfed7367f965a0328cfbdd70da860f15441f002f613185668c6e6ebf5a0ac11 \
-    --hash=sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9 \
-    --hash=sha256:f59e38625469987d7ef6d495323c55e7db6c212eaf6112267e0d3b565a2e9c9f \
-    --hash=sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169 \
-    --hash=sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645
+cryptography==50.0.1 \
+    --hash=sha256:01f41478cf33fc605a6a089cd56d28b45c6c0b45a1928b61797f2621a04bac71 \
+    --hash=sha256:05ba322c4da95b262a212c345af888ef2c37c88c0509756ea00a0e6d68850f23 \
+    --hash=sha256:16c5ecd954b3330ebfb6605eca4fd952da8bef376551d5cc264534e3770a9ee6 \
+    --hash=sha256:2a93d05e34d5f67fba6f891fe85d929999baa7195e853923ea6d7576c9e68c5e \
+    --hash=sha256:2b34d76a652ea2b6faf777c35df230c5637842cd904e04f16230c3f9f03e4361 \
+    --hash=sha256:2ebbfb0f1fed745e91796e3e1080a1440423fdae8ece1b995a1d80883a409054 \
+    --hash=sha256:30a125032e5642a21ff816e021152bd4e7e94f03eff3f4b7fca41cd22bc3110f \
+    --hash=sha256:330fbb252391c596f1ae42c5754449dc924e6ad012dca8efe0d703f9f2d12ec6 \
+    --hash=sha256:359e62deae718bce96170e223fdcb6357e4fbd3bb7a3a75f4430763532560e49 \
+    --hash=sha256:407fe2b6db00939c05c0e945e9914238f2f0a430974839429dafc82b1ee6bee5 \
+    --hash=sha256:42be3bb70596b3abe4ac097b75be223e8b3ab614a0e5de068e3dcc54d71d6149 \
+    --hash=sha256:4c4188f7c0cf655be5c06342b817ed0f9595b69ffa2b12026e5353eed29dea88 \
+    --hash=sha256:51593d180cf6d179bde5c5d065bed81386b1f381656ae7d042b7ffc87a9895ad \
+    --hash=sha256:51afcfceb15597cf2635068e4ac9a56b2abde622edde17f37d85fd7b5306497a \
+    --hash=sha256:53e279950892dc102c6b4e52af03ae5ea92fac572a1ddab78ca73a997f62b69f \
+    --hash=sha256:55d16b1ef3ee0958d893a977b19777887e546c9954ea81b200c3301a864013f2 \
+    --hash=sha256:5dd9bda1c12b4162f6ff568eeb5e0ff956c28d14406e875cfe8a63a2d414ff20 \
+    --hash=sha256:5fe002589592ed749ce77fe0695fcbd3500dd61d7d6db5858a7544c612fa8e45 \
+    --hash=sha256:5fe939deeb161024a6be98229c953b6591fef1f41214497a78fe793a244c017f \
+    --hash=sha256:693c99b49bd37d0d096e4334c10232c77248c415b98d35236094cdf96d57258b \
+    --hash=sha256:76de83fbd91ac49c0feaaa983d0748fd7a53176afac5fb3bf7478d244f0eb527 \
+    --hash=sha256:79bf008d1f9af6071c797ad133e39915dfee7614f18f18f4db9072eb715064a3 \
+    --hash=sha256:804728ce710890870f3aaa344b2e161172d258d768ac139d02cfd9092d0d94e6 \
+    --hash=sha256:8921d58f426793c5f1b47f0b59575780de9a095214958d0eb37d909593db8367 \
+    --hash=sha256:8df2de9102026855887e4587084f6eabd80ed0f345b8ad8a7ac27ab9bf4723e0 \
+    --hash=sha256:9cb3cb952cf5a8abd50c782a98a89d71699715e802fe349704b47f2425b42a94 \
+    --hash=sha256:9dde0a357190eb3b1da1bb9ab750e9c85cba82ca5977aa0836cbb94e92611239 \
+    --hash=sha256:9ebcdd5519be9b652a46f507817a74591774fc3d6923ac364e4dfa64e36b291b \
+    --hash=sha256:a0b1a59e3a089064a0ec309e9428c8e3ae4e161419d20ac33600767e83fc658a \
+    --hash=sha256:a255449073358275b64b67d3f595f268bbef70e72b6edb65e0c70c735bf739c9 \
+    --hash=sha256:a8f40ea47330e71b594a7e246898f93177c259490c63183dbaf9e571d71ed9a5 \
+    --hash=sha256:ac02b07824d4d1001bd4367599f839c19cb171924c796e52c23508ac14c2c0cc \
+    --hash=sha256:aed8db4f6d71c51efb89530e12d9464e7bf2923d46c3205dc794a2a93f8c0648 \
+    --hash=sha256:b8f852c65863251b9e3a1b8c150ce21e59b522dbb6a7d4bc80e680d38388e986 \
+    --hash=sha256:be224a65493ec5b74a158ff22a5522ce4a5ca1e543c647a3a4730d4a09e5f959 \
+    --hash=sha256:ca83d00d9e69cd5eb63f2e69c3a5a59e0cecae5ae14c6ae0b35830fe3b37bad0 \
+    --hash=sha256:cbf74a81765ee67413503ca6e26dcc4f6f5a519822436cc0a1b97aab6c1b8a17 \
+    --hash=sha256:d63ae8f6481fec907ac0f588eee8a90aefde112c633131fe540e5711ddbb5a4e \
+    --hash=sha256:e22dfed744bd4002e909464cb23d2f0b05c6f3113a79ef2e9864a53db737c733 \
+    --hash=sha256:e2ca8fd1b6b4b82a1c4cb02841d0837e3c12336c2e24b520ab8ab3b969733d8f \
+    --hash=sha256:e74591e283fe6eb956416c929eb58262a719fe0311fd9054c62c3350ed8760d8 \
+    --hash=sha256:f74455bb086a85d5e81246412602aaa97ed095e504cd40dd261ef50be42205bf \
+    --hash=sha256:fb4b9672d389c738b175c4166e78310f8a70358886aacd9173ee03a85ffdc671 \
+    --hash=sha256:fc3ed7ebd2a8c96f5b166de0ab9b624996bef3b07bbeb19364dfb78222c22c80 \
+    --hash=sha256:fd3718b960d0b5dd213cdf03f3bcb7000e69dda0de8b956061947ff6bcff5558 \
+    --hash=sha256:ff838d62ec1bfce4f9ba7fa16f4a7b554cd8d0c299e6be37502161a660c84eef
     # via secretstorage
 docutils==0.23 \
     --hash=sha256:25d013af9bf23bc1c7b2b093dff4208166c53a94786c9e447808335ef1185fea \
@@ -346,9 +346,9 @@ idna==3.19 \
     --hash=sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15 \
     --hash=sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4
     # via requests
-importlib-metadata==9.0.0 \
-    --hash=sha256:2d21d1cc5a017bd0559e36150c21c830ab1dc304dedd1b7ea85d20f45ef3edd7 \
-    --hash=sha256:a4f57ab599e6a2e3016d7595cfd72eb4661a5106e787a95bcc90c7105b831efc
+importlib-metadata==9.0.1 \
+    --hash=sha256:ab830580bc0ef3db61ce8fae716389e5462b67e033018bab6d8f80ef17172f99 \
+    --hash=sha256:bba5600596a7e21f3eef53281cf28d6a5195634d2f2b78ff9501a3272c6eaab0
     # via keyring
 jaraco-classes==3.4.0 \
     --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \
@@ -386,34 +386,34 @@ more-itertools==11.1.0 \
     # via
     #   jaraco-classes
     #   jaraco-functools
-nh3==0.3.6 \
-    --hash=sha256:082675ff87b9385ec430ffe6d5847ba7456cc39b73720cd4add472f9f4cffd56 \
-    --hash=sha256:2411e8c3cee81a1ddd62c2a5d50585c28aa5566d373ad1db92536b95ddb24ef2 \
-    --hash=sha256:25c733bee928530556b1db0ea46c52cf5aa686146e38e60a6fc7cb801ef91cec \
-    --hash=sha256:2f90d9a0cfdbee218994fdaaeeb5a0fde62d08f35e4eef0378ec1e2200172fd0 \
-    --hash=sha256:34d2b0d934156b87ee114f599a3ba9b8b9e17b5d79652ba3a13fa50903de965e \
-    --hash=sha256:36d06341bd501240d320f5942481ed5e6846136b666e1ba4faf802b78ebc875f \
-    --hash=sha256:43bc1ed3fa0716295fabee29ba42b2667e4a51d140b0a68e092170a765474fa6 \
-    --hash=sha256:44673b27010051ab5a5e438a86ec31bbda61d4a77d7e900af6b7be3037c1abae \
-    --hash=sha256:455469a29951edc92bc48b47ac2281c3f2609e6c4f6a047056449f8c2c23facf \
-    --hash=sha256:4713502748f564fee0633b37b3403783ce0a3af3a3d148ad91025a5bdadb7bc6 \
-    --hash=sha256:5276ef17bdba9ad8040575c74072008b13aae429436e9d0429e718bb5f90f4da \
-    --hash=sha256:597a8e843bea00b2eb5520658dc24a9bb032e7fc9e7c2c0c4cd29420220c9796 \
-    --hash=sha256:69bbb92865a693d909db3a700d3c01537533844d0948c1e9323561ce06ecda41 \
-    --hash=sha256:69f365963f63a1e9bff53bdbb3c542c7c2efed3e163c9d5d83a772a2ac468c21 \
-    --hash=sha256:82ca5bf427ad1b216b65ede1a2e2d87dc49bec417ceba0f297213107d3cd9d78 \
-    --hash=sha256:889932a97fb4abb6f95fef1914c0d269ebfb60011e67121c1163059b9449dbb4 \
-    --hash=sha256:905f877dc66dd7aea4a76e54bcb26acb5ff8216f720c0017ccf63e0e6035698e \
-    --hash=sha256:a43ebd7543555c3ac1bc353023d0794e75cb76f6f18f19c32e95441496c0cc25 \
-    --hash=sha256:d14bf7982e7a77c0c775634c29c07ce08b38a046df73e1c1f139b3e82f18a38e \
-    --hash=sha256:e196fa70c2ff2eb4de7d3df3108f8f358c1d69dff20d45b11f20a5aa227ffb6d \
-    --hash=sha256:e1b160831c9cdb06a6c79c2f9cdb11386602938f9af260d1c457a85add4f6f69 \
-    --hash=sha256:e6b7beece07525dc6e6b0fc2f104442de2ba328360ad00e50cbe2e1fd620447d \
-    --hash=sha256:edb2b4a1a27523e6cc7c417f8d21ce3d005243548b93e56b762b66b0c7f589f9 \
-    --hash=sha256:f2f14b7ae1fca99c4a66c981aac3974e7fbc1ca30a12673d223ae1df76680917 \
-    --hash=sha256:f338ac7d594c067679f1e99b4f5ec3906842979560f9d8f15d6bdfa39a353b10 \
-    --hash=sha256:f3736c9dd3d1856f80cd031715b84ca75cda2bbb1ac802c3da26bfce590838d7 \
-    --hash=sha256:f5ed5fe84aee7f39db95c214a7421bf0499fbf500fec6d86a4e29bfc37971438
+nh3==0.3.7 \
+    --hash=sha256:157ec1eb7a62f3d9a7badb8d82d89aa810e3e24e097eedfa481a25d0c8a99877 \
+    --hash=sha256:15f5fbf090f5c88d61c820e1fc1fceecb6520cca9fe85649c06b57ef9dc9ff62 \
+    --hash=sha256:18f4278ecd157d43cb35acd5aae9f35cfa79f546b4922bd86536adc0f6312102 \
+    --hash=sha256:19f288c938ec6eef1f5d2c6cab47838e71fef8097e1c1233802be5a6230ba086 \
+    --hash=sha256:4968fe8d2db97c6f047659bf46a449fd8ec377f44ebf3e0a1b96c0d3a333ae32 \
+    --hash=sha256:5ffdfcb9a686ffb12765376bcfb6b5b55728516d3c0ee317d29982381ded3df8 \
+    --hash=sha256:614dac4a4c36ad084e78447d16fe898dedd762e354a7ab9cda2984e82f67883d \
+    --hash=sha256:618e3059caf41ccdf5dcccb3fa9df4cf6e4efe23d1382a8bbfca272a8a4f8bfc \
+    --hash=sha256:6698a822132beedab80f131c08d8d0ac5a178ddeb488d02ca4b67716ecfac7af \
+    --hash=sha256:6c3aa50eb26e9228238271db9f983cbc3b006dfbfeca2d4dc34c33ddc6ac5ea5 \
+    --hash=sha256:6e4280115d44c3b278eef712a86748c1a723105cd79feec46952383117ab4e59 \
+    --hash=sha256:70f5ac8626e899a4bab0ef74ca2f5bd602f49c7b739e6e5026b4afc6d63dac42 \
+    --hash=sha256:71860d01c16f4d8c72e334e0674beb2b0899dbd0bf760de18932ef4390303848 \
+    --hash=sha256:808def0c8c07843e6e50dc84f532457bfa2cfd17417b219a5d9e7c773709331a \
+    --hash=sha256:874b7d67a067bd29a59223f6270fc30da4edd8e6d87fd219fc93bcbaa662c946 \
+    --hash=sha256:91a4dab4e94d9fc54b9f67b1adfb23e81fab7ab43f33c3b8c97be9aa38f789ba \
+    --hash=sha256:94fd6e59553fbb9ffd8ba71bbd5a54e3126ba01799a097ae30d5341d750bc6ac \
+    --hash=sha256:9b7279d43323a25225df23576af6594a16693f61431170848b8b2ac21ad4f174 \
+    --hash=sha256:bc42bb1193c1e28a1e74c2cabaca178e118a7103e8832699fef8a2b3e2496493 \
+    --hash=sha256:be53a4825585f701955cb9baf49f478f56eb81e20294329fe4bc689dd5dd81fa \
+    --hash=sha256:d56e76bd3cadb09b6b0cef364850811663734b348a25f5f587a2819c495367bd \
+    --hash=sha256:de2b2aab32ea303405debefdcfc58043d3e635fa3f67b9eb140d2b0e0c0d2563 \
+    --hash=sha256:e8fd1ab205258b29254f72db377d99e2c96aa7653ef3b015ccab0420b094b506 \
+    --hash=sha256:eae64328e46a25785535afcb6885b6f182ecaf5ee8c88f8c075422db8aacc65b \
+    --hash=sha256:f04b7d333b27f13ca439da3cf1c75c2fba34f104969f6ce4ac8e7079699c2f4a \
+    --hash=sha256:f266d3f1b3647449923a8e406524632220dd5d8b647078dfe45b885d33d10479 \
+    --hash=sha256:fd4a70efb45d5372174f718878eb7a35c12677626a63b2f103b23b833457dcac
     # via readme-renderer
 packaging==26.3 \
     --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
@@ -429,9 +429,9 @@ pygments==2.21.0 \
     # via
     #   readme-renderer
     #   rich
-readme-renderer==45.0 \
-    --hash=sha256:030a8fac74904f8fba11ad1bb6964e3f76e896dc7e5e71f16af190c9056696d1 \
-    --hash=sha256:3385ed220117104a2bceb4a9dac8c5fdf6d1f96890d7ea2a9c7174fd5c84091f
+readme-renderer==46.0 \
+    --hash=sha256:af3e964914f6310a33ff67b72a4bdd940bed8d7c3bdecd2d14f40edf284bfe90 \
+    --hash=sha256:d0dae1f74bb273b534770cb4cccb6bb78735540afdb03c2146f4e19dcd412560
     # via twine
 requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
@@ -458,7 +458,7 @@ secretstorage==3.5.0 \
 twine==7.0.0 \
     --hash=sha256:85cdb29c518efef867360ae4acd4b0dfd61c8654a22fca08e6f8539f05022177 \
     --hash=sha256:b854164df26db268af05f49aa5c0344b10e27a494343ff05b1e0bad3b135f5a7
-    # via rules-python-publish-deps (tools/publish/pyproject.toml)
+    # via rules-python-publish-deps (pyproject.toml)
 urllib3==2.7.0 \
     --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
     --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
diff --git a/tools/publish/requirements_universal.txt b/tools/publish/requirements_universal.txt
index e20fa07e2f..a0a28091ac 100644
--- a/tools/publish/requirements_universal.txt
+++ b/tools/publish/requirements_universal.txt
@@ -286,53 +286,53 @@ charset-normalizer==3.5.1 \
     --hash=sha256:fd0a274c0e5f9a21565cd9d3dd749b61f96b7aa1e20a93aa1ba4029518f2e5c0 \
     --hash=sha256:fdb8a068947befafba9952162645dc2fecaeb400e64584829ed5e9b2fbe21a7f
     # via requests
-cryptography==50.0.0 ; platform_machine != 'ppc64le' and platform_machine != 's390x' and sys_platform == 'linux' \
-    --hash=sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03 \
-    --hash=sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7 \
-    --hash=sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437 \
-    --hash=sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987 \
-    --hash=sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025 \
-    --hash=sha256:11b74db56cdbe3cdee6e3f6982ecb70334fa10dce99ed58bf7894aaaa3b2a037 \
-    --hash=sha256:12b9c6996425c76ea6c457ace4f3073e715b8c545add07cd1a8f3a4f90691269 \
-    --hash=sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105 \
-    --hash=sha256:19736989797678c6af1e55cd49055cdbcb55d8f6b5583ac5335f933aba9101dc \
-    --hash=sha256:1b4a266766514614f8aa60416e71f2fc6e575d36e7bdc90f644fadb2f4b75b95 \
-    --hash=sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b \
-    --hash=sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47 \
-    --hash=sha256:3f5735ffe4996d28b809371756219f5354864902a3b9e7c0b9ee87041209fc9c \
-    --hash=sha256:49e7d93abdbd2990caced757e5fade25302f719c3c8fb6e6fff2dde98999fc41 \
-    --hash=sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c \
-    --hash=sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d \
-    --hash=sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7 \
-    --hash=sha256:6ba6a53445bd3cfa809ef3ef5f1589aa6ba08784a1d962bf47d0940e871dab1c \
-    --hash=sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708 \
-    --hash=sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef \
-    --hash=sha256:80b63928fa35083b33966ce1efb70e5b9607181e49dcd1c22c8c005e319f667f \
-    --hash=sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f \
-    --hash=sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a \
-    --hash=sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f \
-    --hash=sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a \
-    --hash=sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a \
-    --hash=sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e \
-    --hash=sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3 \
-    --hash=sha256:9aa87839c383bdbab6ef865787a1fb877af8dd03464c4400322726feaaadfc6d \
-    --hash=sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3 \
-    --hash=sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f \
-    --hash=sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae \
-    --hash=sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30 \
-    --hash=sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9 \
-    --hash=sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9 \
-    --hash=sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07 \
-    --hash=sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba \
-    --hash=sha256:d58c3db7cd6eed54e6c06744db55456b65ebd7492ddeae9c1e93cfca7aa857d3 \
-    --hash=sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f \
-    --hash=sha256:df2a58a472f332225671c35b0a830208b86d004f82baa8530fa3782c85646533 \
-    --hash=sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5 \
-    --hash=sha256:ecfed7367f965a0328cfbdd70da860f15441f002f613185668c6e6ebf5a0ac11 \
-    --hash=sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9 \
-    --hash=sha256:f59e38625469987d7ef6d495323c55e7db6c212eaf6112267e0d3b565a2e9c9f \
-    --hash=sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169 \
-    --hash=sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645
+cryptography==50.0.1 ; platform_machine != 'ppc64le' and platform_machine != 's390x' and sys_platform == 'linux' \
+    --hash=sha256:01f41478cf33fc605a6a089cd56d28b45c6c0b45a1928b61797f2621a04bac71 \
+    --hash=sha256:05ba322c4da95b262a212c345af888ef2c37c88c0509756ea00a0e6d68850f23 \
+    --hash=sha256:16c5ecd954b3330ebfb6605eca4fd952da8bef376551d5cc264534e3770a9ee6 \
+    --hash=sha256:2a93d05e34d5f67fba6f891fe85d929999baa7195e853923ea6d7576c9e68c5e \
+    --hash=sha256:2b34d76a652ea2b6faf777c35df230c5637842cd904e04f16230c3f9f03e4361 \
+    --hash=sha256:2ebbfb0f1fed745e91796e3e1080a1440423fdae8ece1b995a1d80883a409054 \
+    --hash=sha256:30a125032e5642a21ff816e021152bd4e7e94f03eff3f4b7fca41cd22bc3110f \
+    --hash=sha256:330fbb252391c596f1ae42c5754449dc924e6ad012dca8efe0d703f9f2d12ec6 \
+    --hash=sha256:359e62deae718bce96170e223fdcb6357e4fbd3bb7a3a75f4430763532560e49 \
+    --hash=sha256:407fe2b6db00939c05c0e945e9914238f2f0a430974839429dafc82b1ee6bee5 \
+    --hash=sha256:42be3bb70596b3abe4ac097b75be223e8b3ab614a0e5de068e3dcc54d71d6149 \
+    --hash=sha256:4c4188f7c0cf655be5c06342b817ed0f9595b69ffa2b12026e5353eed29dea88 \
+    --hash=sha256:51593d180cf6d179bde5c5d065bed81386b1f381656ae7d042b7ffc87a9895ad \
+    --hash=sha256:51afcfceb15597cf2635068e4ac9a56b2abde622edde17f37d85fd7b5306497a \
+    --hash=sha256:53e279950892dc102c6b4e52af03ae5ea92fac572a1ddab78ca73a997f62b69f \
+    --hash=sha256:55d16b1ef3ee0958d893a977b19777887e546c9954ea81b200c3301a864013f2 \
+    --hash=sha256:5dd9bda1c12b4162f6ff568eeb5e0ff956c28d14406e875cfe8a63a2d414ff20 \
+    --hash=sha256:5fe002589592ed749ce77fe0695fcbd3500dd61d7d6db5858a7544c612fa8e45 \
+    --hash=sha256:5fe939deeb161024a6be98229c953b6591fef1f41214497a78fe793a244c017f \
+    --hash=sha256:693c99b49bd37d0d096e4334c10232c77248c415b98d35236094cdf96d57258b \
+    --hash=sha256:76de83fbd91ac49c0feaaa983d0748fd7a53176afac5fb3bf7478d244f0eb527 \
+    --hash=sha256:79bf008d1f9af6071c797ad133e39915dfee7614f18f18f4db9072eb715064a3 \
+    --hash=sha256:804728ce710890870f3aaa344b2e161172d258d768ac139d02cfd9092d0d94e6 \
+    --hash=sha256:8921d58f426793c5f1b47f0b59575780de9a095214958d0eb37d909593db8367 \
+    --hash=sha256:8df2de9102026855887e4587084f6eabd80ed0f345b8ad8a7ac27ab9bf4723e0 \
+    --hash=sha256:9cb3cb952cf5a8abd50c782a98a89d71699715e802fe349704b47f2425b42a94 \
+    --hash=sha256:9dde0a357190eb3b1da1bb9ab750e9c85cba82ca5977aa0836cbb94e92611239 \
+    --hash=sha256:9ebcdd5519be9b652a46f507817a74591774fc3d6923ac364e4dfa64e36b291b \
+    --hash=sha256:a0b1a59e3a089064a0ec309e9428c8e3ae4e161419d20ac33600767e83fc658a \
+    --hash=sha256:a255449073358275b64b67d3f595f268bbef70e72b6edb65e0c70c735bf739c9 \
+    --hash=sha256:a8f40ea47330e71b594a7e246898f93177c259490c63183dbaf9e571d71ed9a5 \
+    --hash=sha256:ac02b07824d4d1001bd4367599f839c19cb171924c796e52c23508ac14c2c0cc \
+    --hash=sha256:aed8db4f6d71c51efb89530e12d9464e7bf2923d46c3205dc794a2a93f8c0648 \
+    --hash=sha256:b8f852c65863251b9e3a1b8c150ce21e59b522dbb6a7d4bc80e680d38388e986 \
+    --hash=sha256:be224a65493ec5b74a158ff22a5522ce4a5ca1e543c647a3a4730d4a09e5f959 \
+    --hash=sha256:ca83d00d9e69cd5eb63f2e69c3a5a59e0cecae5ae14c6ae0b35830fe3b37bad0 \
+    --hash=sha256:cbf74a81765ee67413503ca6e26dcc4f6f5a519822436cc0a1b97aab6c1b8a17 \
+    --hash=sha256:d63ae8f6481fec907ac0f588eee8a90aefde112c633131fe540e5711ddbb5a4e \
+    --hash=sha256:e22dfed744bd4002e909464cb23d2f0b05c6f3113a79ef2e9864a53db737c733 \
+    --hash=sha256:e2ca8fd1b6b4b82a1c4cb02841d0837e3c12336c2e24b520ab8ab3b969733d8f \
+    --hash=sha256:e74591e283fe6eb956416c929eb58262a719fe0311fd9054c62c3350ed8760d8 \
+    --hash=sha256:f74455bb086a85d5e81246412602aaa97ed095e504cd40dd261ef50be42205bf \
+    --hash=sha256:fb4b9672d389c738b175c4166e78310f8a70358886aacd9173ee03a85ffdc671 \
+    --hash=sha256:fc3ed7ebd2a8c96f5b166de0ab9b624996bef3b07bbeb19364dfb78222c22c80 \
+    --hash=sha256:fd3718b960d0b5dd213cdf03f3bcb7000e69dda0de8b956061947ff6bcff5558 \
+    --hash=sha256:ff838d62ec1bfce4f9ba7fa16f4a7b554cd8d0c299e6be37502161a660c84eef
     # via secretstorage
 docutils==0.23 \
     --hash=sha256:25d013af9bf23bc1c7b2b093dff4208166c53a94786c9e447808335ef1185fea \
@@ -346,9 +346,9 @@ idna==3.19 \
     --hash=sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15 \
     --hash=sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4
     # via requests
-importlib-metadata==9.0.0 ; python_full_version < '3.12' and platform_machine != 'ppc64le' and platform_machine != 's390x' \
-    --hash=sha256:2d21d1cc5a017bd0559e36150c21c830ab1dc304dedd1b7ea85d20f45ef3edd7 \
-    --hash=sha256:a4f57ab599e6a2e3016d7595cfd72eb4661a5106e787a95bcc90c7105b831efc
+importlib-metadata==9.0.1 ; python_full_version < '3.12' and platform_machine != 'ppc64le' and platform_machine != 's390x' \
+    --hash=sha256:ab830580bc0ef3db61ce8fae716389e5462b67e033018bab6d8f80ef17172f99 \
+    --hash=sha256:bba5600596a7e21f3eef53281cf28d6a5195634d2f2b78ff9501a3272c6eaab0
     # via keyring
 jaraco-classes==3.4.0 ; platform_machine != 'ppc64le' and platform_machine != 's390x' \
     --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \
@@ -386,34 +386,34 @@ more-itertools==11.1.0 ; platform_machine != 'ppc64le' and platform_machine != '
     # via
     #   jaraco-classes
     #   jaraco-functools
-nh3==0.3.6 \
-    --hash=sha256:082675ff87b9385ec430ffe6d5847ba7456cc39b73720cd4add472f9f4cffd56 \
-    --hash=sha256:2411e8c3cee81a1ddd62c2a5d50585c28aa5566d373ad1db92536b95ddb24ef2 \
-    --hash=sha256:25c733bee928530556b1db0ea46c52cf5aa686146e38e60a6fc7cb801ef91cec \
-    --hash=sha256:2f90d9a0cfdbee218994fdaaeeb5a0fde62d08f35e4eef0378ec1e2200172fd0 \
-    --hash=sha256:34d2b0d934156b87ee114f599a3ba9b8b9e17b5d79652ba3a13fa50903de965e \
-    --hash=sha256:36d06341bd501240d320f5942481ed5e6846136b666e1ba4faf802b78ebc875f \
-    --hash=sha256:43bc1ed3fa0716295fabee29ba42b2667e4a51d140b0a68e092170a765474fa6 \
-    --hash=sha256:44673b27010051ab5a5e438a86ec31bbda61d4a77d7e900af6b7be3037c1abae \
-    --hash=sha256:455469a29951edc92bc48b47ac2281c3f2609e6c4f6a047056449f8c2c23facf \
-    --hash=sha256:4713502748f564fee0633b37b3403783ce0a3af3a3d148ad91025a5bdadb7bc6 \
-    --hash=sha256:5276ef17bdba9ad8040575c74072008b13aae429436e9d0429e718bb5f90f4da \
-    --hash=sha256:597a8e843bea00b2eb5520658dc24a9bb032e7fc9e7c2c0c4cd29420220c9796 \
-    --hash=sha256:69bbb92865a693d909db3a700d3c01537533844d0948c1e9323561ce06ecda41 \
-    --hash=sha256:69f365963f63a1e9bff53bdbb3c542c7c2efed3e163c9d5d83a772a2ac468c21 \
-    --hash=sha256:82ca5bf427ad1b216b65ede1a2e2d87dc49bec417ceba0f297213107d3cd9d78 \
-    --hash=sha256:889932a97fb4abb6f95fef1914c0d269ebfb60011e67121c1163059b9449dbb4 \
-    --hash=sha256:905f877dc66dd7aea4a76e54bcb26acb5ff8216f720c0017ccf63e0e6035698e \
-    --hash=sha256:a43ebd7543555c3ac1bc353023d0794e75cb76f6f18f19c32e95441496c0cc25 \
-    --hash=sha256:d14bf7982e7a77c0c775634c29c07ce08b38a046df73e1c1f139b3e82f18a38e \
-    --hash=sha256:e196fa70c2ff2eb4de7d3df3108f8f358c1d69dff20d45b11f20a5aa227ffb6d \
-    --hash=sha256:e1b160831c9cdb06a6c79c2f9cdb11386602938f9af260d1c457a85add4f6f69 \
-    --hash=sha256:e6b7beece07525dc6e6b0fc2f104442de2ba328360ad00e50cbe2e1fd620447d \
-    --hash=sha256:edb2b4a1a27523e6cc7c417f8d21ce3d005243548b93e56b762b66b0c7f589f9 \
-    --hash=sha256:f2f14b7ae1fca99c4a66c981aac3974e7fbc1ca30a12673d223ae1df76680917 \
-    --hash=sha256:f338ac7d594c067679f1e99b4f5ec3906842979560f9d8f15d6bdfa39a353b10 \
-    --hash=sha256:f3736c9dd3d1856f80cd031715b84ca75cda2bbb1ac802c3da26bfce590838d7 \
-    --hash=sha256:f5ed5fe84aee7f39db95c214a7421bf0499fbf500fec6d86a4e29bfc37971438
+nh3==0.3.7 \
+    --hash=sha256:157ec1eb7a62f3d9a7badb8d82d89aa810e3e24e097eedfa481a25d0c8a99877 \
+    --hash=sha256:15f5fbf090f5c88d61c820e1fc1fceecb6520cca9fe85649c06b57ef9dc9ff62 \
+    --hash=sha256:18f4278ecd157d43cb35acd5aae9f35cfa79f546b4922bd86536adc0f6312102 \
+    --hash=sha256:19f288c938ec6eef1f5d2c6cab47838e71fef8097e1c1233802be5a6230ba086 \
+    --hash=sha256:4968fe8d2db97c6f047659bf46a449fd8ec377f44ebf3e0a1b96c0d3a333ae32 \
+    --hash=sha256:5ffdfcb9a686ffb12765376bcfb6b5b55728516d3c0ee317d29982381ded3df8 \
+    --hash=sha256:614dac4a4c36ad084e78447d16fe898dedd762e354a7ab9cda2984e82f67883d \
+    --hash=sha256:618e3059caf41ccdf5dcccb3fa9df4cf6e4efe23d1382a8bbfca272a8a4f8bfc \
+    --hash=sha256:6698a822132beedab80f131c08d8d0ac5a178ddeb488d02ca4b67716ecfac7af \
+    --hash=sha256:6c3aa50eb26e9228238271db9f983cbc3b006dfbfeca2d4dc34c33ddc6ac5ea5 \
+    --hash=sha256:6e4280115d44c3b278eef712a86748c1a723105cd79feec46952383117ab4e59 \
+    --hash=sha256:70f5ac8626e899a4bab0ef74ca2f5bd602f49c7b739e6e5026b4afc6d63dac42 \
+    --hash=sha256:71860d01c16f4d8c72e334e0674beb2b0899dbd0bf760de18932ef4390303848 \
+    --hash=sha256:808def0c8c07843e6e50dc84f532457bfa2cfd17417b219a5d9e7c773709331a \
+    --hash=sha256:874b7d67a067bd29a59223f6270fc30da4edd8e6d87fd219fc93bcbaa662c946 \
+    --hash=sha256:91a4dab4e94d9fc54b9f67b1adfb23e81fab7ab43f33c3b8c97be9aa38f789ba \
+    --hash=sha256:94fd6e59553fbb9ffd8ba71bbd5a54e3126ba01799a097ae30d5341d750bc6ac \
+    --hash=sha256:9b7279d43323a25225df23576af6594a16693f61431170848b8b2ac21ad4f174 \
+    --hash=sha256:bc42bb1193c1e28a1e74c2cabaca178e118a7103e8832699fef8a2b3e2496493 \
+    --hash=sha256:be53a4825585f701955cb9baf49f478f56eb81e20294329fe4bc689dd5dd81fa \
+    --hash=sha256:d56e76bd3cadb09b6b0cef364850811663734b348a25f5f587a2819c495367bd \
+    --hash=sha256:de2b2aab32ea303405debefdcfc58043d3e635fa3f67b9eb140d2b0e0c0d2563 \
+    --hash=sha256:e8fd1ab205258b29254f72db377d99e2c96aa7653ef3b015ccab0420b094b506 \
+    --hash=sha256:eae64328e46a25785535afcb6885b6f182ecaf5ee8c88f8c075422db8aacc65b \
+    --hash=sha256:f04b7d333b27f13ca439da3cf1c75c2fba34f104969f6ce4ac8e7079699c2f4a \
+    --hash=sha256:f266d3f1b3647449923a8e406524632220dd5d8b647078dfe45b885d33d10479 \
+    --hash=sha256:fd4a70efb45d5372174f718878eb7a35c12677626a63b2f103b23b833457dcac
     # via readme-renderer
 packaging==26.3 \
     --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
@@ -433,9 +433,9 @@ pywin32-ctypes==0.2.3 ; platform_machine != 'ppc64le' and platform_machine != 's
     --hash=sha256:8a1513379d709975552d202d942d9837758905c8d01eb82b8bcc30918929e7b8 \
     --hash=sha256:d162dc04946d704503b2edc4d55f3dba5c1d539ead017afa00142c38b9885755
     # via keyring
-readme-renderer==45.0 \
-    --hash=sha256:030a8fac74904f8fba11ad1bb6964e3f76e896dc7e5e71f16af190c9056696d1 \
-    --hash=sha256:3385ed220117104a2bceb4a9dac8c5fdf6d1f96890d7ea2a9c7174fd5c84091f
+readme-renderer==46.0 \
+    --hash=sha256:af3e964914f6310a33ff67b72a4bdd940bed8d7c3bdecd2d14f40edf284bfe90 \
+    --hash=sha256:d0dae1f74bb273b534770cb4cccb6bb78735540afdb03c2146f4e19dcd412560
     # via twine
 requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
@@ -462,7 +462,7 @@ secretstorage==3.5.0 ; platform_machine != 'ppc64le' and platform_machine != 's3
 twine==7.0.0 \
     --hash=sha256:85cdb29c518efef867360ae4acd4b0dfd61c8654a22fca08e6f8539f05022177 \
     --hash=sha256:b854164df26db268af05f49aa5c0344b10e27a494343ff05b1e0bad3b135f5a7
-    # via rules-python-publish-deps (tools/publish/pyproject.toml)
+    # via rules-python-publish-deps (pyproject.toml)
 urllib3==2.7.0 \
     --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
     --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
diff --git a/tools/publish/requirements_windows.txt b/tools/publish/requirements_windows.txt
index 98c85fca96..95de3ce933 100644
--- a/tools/publish/requirements_windows.txt
+++ b/tools/publish/requirements_windows.txt
@@ -196,9 +196,9 @@ idna==3.19 \
     --hash=sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15 \
     --hash=sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4
     # via requests
-importlib-metadata==9.0.0 \
-    --hash=sha256:2d21d1cc5a017bd0559e36150c21c830ab1dc304dedd1b7ea85d20f45ef3edd7 \
-    --hash=sha256:a4f57ab599e6a2e3016d7595cfd72eb4661a5106e787a95bcc90c7105b831efc
+importlib-metadata==9.0.1 \
+    --hash=sha256:ab830580bc0ef3db61ce8fae716389e5462b67e033018bab6d8f80ef17172f99 \
+    --hash=sha256:bba5600596a7e21f3eef53281cf28d6a5195634d2f2b78ff9501a3272c6eaab0
     # via keyring
 jaraco-classes==3.4.0 \
     --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \
@@ -230,34 +230,34 @@ more-itertools==11.1.0 \
     # via
     #   jaraco-classes
     #   jaraco-functools
-nh3==0.3.6 \
-    --hash=sha256:082675ff87b9385ec430ffe6d5847ba7456cc39b73720cd4add472f9f4cffd56 \
-    --hash=sha256:2411e8c3cee81a1ddd62c2a5d50585c28aa5566d373ad1db92536b95ddb24ef2 \
-    --hash=sha256:25c733bee928530556b1db0ea46c52cf5aa686146e38e60a6fc7cb801ef91cec \
-    --hash=sha256:2f90d9a0cfdbee218994fdaaeeb5a0fde62d08f35e4eef0378ec1e2200172fd0 \
-    --hash=sha256:34d2b0d934156b87ee114f599a3ba9b8b9e17b5d79652ba3a13fa50903de965e \
-    --hash=sha256:36d06341bd501240d320f5942481ed5e6846136b666e1ba4faf802b78ebc875f \
-    --hash=sha256:43bc1ed3fa0716295fabee29ba42b2667e4a51d140b0a68e092170a765474fa6 \
-    --hash=sha256:44673b27010051ab5a5e438a86ec31bbda61d4a77d7e900af6b7be3037c1abae \
-    --hash=sha256:455469a29951edc92bc48b47ac2281c3f2609e6c4f6a047056449f8c2c23facf \
-    --hash=sha256:4713502748f564fee0633b37b3403783ce0a3af3a3d148ad91025a5bdadb7bc6 \
-    --hash=sha256:5276ef17bdba9ad8040575c74072008b13aae429436e9d0429e718bb5f90f4da \
-    --hash=sha256:597a8e843bea00b2eb5520658dc24a9bb032e7fc9e7c2c0c4cd29420220c9796 \
-    --hash=sha256:69bbb92865a693d909db3a700d3c01537533844d0948c1e9323561ce06ecda41 \
-    --hash=sha256:69f365963f63a1e9bff53bdbb3c542c7c2efed3e163c9d5d83a772a2ac468c21 \
-    --hash=sha256:82ca5bf427ad1b216b65ede1a2e2d87dc49bec417ceba0f297213107d3cd9d78 \
-    --hash=sha256:889932a97fb4abb6f95fef1914c0d269ebfb60011e67121c1163059b9449dbb4 \
-    --hash=sha256:905f877dc66dd7aea4a76e54bcb26acb5ff8216f720c0017ccf63e0e6035698e \
-    --hash=sha256:a43ebd7543555c3ac1bc353023d0794e75cb76f6f18f19c32e95441496c0cc25 \
-    --hash=sha256:d14bf7982e7a77c0c775634c29c07ce08b38a046df73e1c1f139b3e82f18a38e \
-    --hash=sha256:e196fa70c2ff2eb4de7d3df3108f8f358c1d69dff20d45b11f20a5aa227ffb6d \
-    --hash=sha256:e1b160831c9cdb06a6c79c2f9cdb11386602938f9af260d1c457a85add4f6f69 \
-    --hash=sha256:e6b7beece07525dc6e6b0fc2f104442de2ba328360ad00e50cbe2e1fd620447d \
-    --hash=sha256:edb2b4a1a27523e6cc7c417f8d21ce3d005243548b93e56b762b66b0c7f589f9 \
-    --hash=sha256:f2f14b7ae1fca99c4a66c981aac3974e7fbc1ca30a12673d223ae1df76680917 \
-    --hash=sha256:f338ac7d594c067679f1e99b4f5ec3906842979560f9d8f15d6bdfa39a353b10 \
-    --hash=sha256:f3736c9dd3d1856f80cd031715b84ca75cda2bbb1ac802c3da26bfce590838d7 \
-    --hash=sha256:f5ed5fe84aee7f39db95c214a7421bf0499fbf500fec6d86a4e29bfc37971438
+nh3==0.3.7 \
+    --hash=sha256:157ec1eb7a62f3d9a7badb8d82d89aa810e3e24e097eedfa481a25d0c8a99877 \
+    --hash=sha256:15f5fbf090f5c88d61c820e1fc1fceecb6520cca9fe85649c06b57ef9dc9ff62 \
+    --hash=sha256:18f4278ecd157d43cb35acd5aae9f35cfa79f546b4922bd86536adc0f6312102 \
+    --hash=sha256:19f288c938ec6eef1f5d2c6cab47838e71fef8097e1c1233802be5a6230ba086 \
+    --hash=sha256:4968fe8d2db97c6f047659bf46a449fd8ec377f44ebf3e0a1b96c0d3a333ae32 \
+    --hash=sha256:5ffdfcb9a686ffb12765376bcfb6b5b55728516d3c0ee317d29982381ded3df8 \
+    --hash=sha256:614dac4a4c36ad084e78447d16fe898dedd762e354a7ab9cda2984e82f67883d \
+    --hash=sha256:618e3059caf41ccdf5dcccb3fa9df4cf6e4efe23d1382a8bbfca272a8a4f8bfc \
+    --hash=sha256:6698a822132beedab80f131c08d8d0ac5a178ddeb488d02ca4b67716ecfac7af \
+    --hash=sha256:6c3aa50eb26e9228238271db9f983cbc3b006dfbfeca2d4dc34c33ddc6ac5ea5 \
+    --hash=sha256:6e4280115d44c3b278eef712a86748c1a723105cd79feec46952383117ab4e59 \
+    --hash=sha256:70f5ac8626e899a4bab0ef74ca2f5bd602f49c7b739e6e5026b4afc6d63dac42 \
+    --hash=sha256:71860d01c16f4d8c72e334e0674beb2b0899dbd0bf760de18932ef4390303848 \
+    --hash=sha256:808def0c8c07843e6e50dc84f532457bfa2cfd17417b219a5d9e7c773709331a \
+    --hash=sha256:874b7d67a067bd29a59223f6270fc30da4edd8e6d87fd219fc93bcbaa662c946 \
+    --hash=sha256:91a4dab4e94d9fc54b9f67b1adfb23e81fab7ab43f33c3b8c97be9aa38f789ba \
+    --hash=sha256:94fd6e59553fbb9ffd8ba71bbd5a54e3126ba01799a097ae30d5341d750bc6ac \
+    --hash=sha256:9b7279d43323a25225df23576af6594a16693f61431170848b8b2ac21ad4f174 \
+    --hash=sha256:bc42bb1193c1e28a1e74c2cabaca178e118a7103e8832699fef8a2b3e2496493 \
+    --hash=sha256:be53a4825585f701955cb9baf49f478f56eb81e20294329fe4bc689dd5dd81fa \
+    --hash=sha256:d56e76bd3cadb09b6b0cef364850811663734b348a25f5f587a2819c495367bd \
+    --hash=sha256:de2b2aab32ea303405debefdcfc58043d3e635fa3f67b9eb140d2b0e0c0d2563 \
+    --hash=sha256:e8fd1ab205258b29254f72db377d99e2c96aa7653ef3b015ccab0420b094b506 \
+    --hash=sha256:eae64328e46a25785535afcb6885b6f182ecaf5ee8c88f8c075422db8aacc65b \
+    --hash=sha256:f04b7d333b27f13ca439da3cf1c75c2fba34f104969f6ce4ac8e7079699c2f4a \
+    --hash=sha256:f266d3f1b3647449923a8e406524632220dd5d8b647078dfe45b885d33d10479 \
+    --hash=sha256:fd4a70efb45d5372174f718878eb7a35c12677626a63b2f103b23b833457dcac
     # via readme-renderer
 packaging==26.3 \
     --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
@@ -273,9 +273,9 @@ pywin32-ctypes==0.2.3 \
     --hash=sha256:8a1513379d709975552d202d942d9837758905c8d01eb82b8bcc30918929e7b8 \
     --hash=sha256:d162dc04946d704503b2edc4d55f3dba5c1d539ead017afa00142c38b9885755
     # via keyring
-readme-renderer==45.0 \
-    --hash=sha256:030a8fac74904f8fba11ad1bb6964e3f76e896dc7e5e71f16af190c9056696d1 \
-    --hash=sha256:3385ed220117104a2bceb4a9dac8c5fdf6d1f96890d7ea2a9c7174fd5c84091f
+readme-renderer==46.0 \
+    --hash=sha256:af3e964914f6310a33ff67b72a4bdd940bed8d7c3bdecd2d14f40edf284bfe90 \
+    --hash=sha256:d0dae1f74bb273b534770cb4cccb6bb78735540afdb03c2146f4e19dcd412560
     # via twine
 requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
@@ -298,7 +298,7 @@ rich==15.0.0 \
 twine==7.0.0 \
     --hash=sha256:85cdb29c518efef867360ae4acd4b0dfd61c8654a22fca08e6f8539f05022177 \
     --hash=sha256:b854164df26db268af05f49aa5c0344b10e27a494343ff05b1e0bad3b135f5a7
-    # via rules-python-publish-deps (tools/publish/pyproject.toml)
+    # via rules-python-publish-deps (pyproject.toml)
 urllib3==2.7.0 \
     --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
     --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897

From cd606ba7ce2702c58810b2fe01930402da771f10 Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Wed, 2 Sep 2026 10:23:15 +0900
Subject: [PATCH 16/16] fix tests

---
 python/uv/private/lock.bzl              |  3 +++
 tests/uv/lock/testdata/requirements.txt | 14 +++++++-------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/python/uv/private/lock.bzl b/python/uv/private/lock.bzl
index 61af2d5163..4660596208 100644
--- a/python/uv/private/lock.bzl
+++ b/python/uv/private/lock.bzl
@@ -90,6 +90,9 @@ def _reroot(x, directory):
     if hasattr(x, "path"):
         x = x.path
 
+    if x == directory:
+        return "."
+
     return paths.relativize(x, directory)
 
 def _reroot_all(xs, directory):
diff --git a/tests/uv/lock/testdata/requirements.txt b/tests/uv/lock/testdata/requirements.txt
index 5070d93d98..bd9494266b 100644
--- a/tests/uv/lock/testdata/requirements.txt
+++ b/tests/uv/lock/testdata/requirements.txt
@@ -4,7 +4,7 @@ certifi==2025.1.31 \
     --hash=sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651 \
     --hash=sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
+    #   -c testdata/constraints.txt
     #   requests
 charset-normalizer==3.4.0 \
     --hash=sha256:0099d79bdfcf5c1f0c2c72f91516702ebf8b0b8ddd8905f97a8aecf49712c621 \
@@ -113,24 +113,24 @@ charset-normalizer==3.4.0 \
     --hash=sha256:fe9f97feb71aa9896b81973a7bbada8c49501dc73e58a10fcef6663af95e5079 \
     --hash=sha256:ffc519621dce0c767e96b9c53f09c5d215578e10b02c285809f76509a3931482
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
-    #   -c tests/uv/lock/testdata/constraints2.txt
+    #   -c testdata/constraints.txt
+    #   -c testdata/constraints2.txt
     #   requests
 idna==3.15 \
     --hash=sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8 \
     --hash=sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
+    #   -c testdata/constraints.txt
     #   requests
 requests==2.33.0 \
     --hash=sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b \
     --hash=sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
-    #   -r tests/uv/lock/testdata/requirements.in
+    #   -c testdata/constraints.txt
+    #   -r testdata/requirements.in
 urllib3==2.7.0 \
     --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
     --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
     # via
-    #   -c tests/uv/lock/testdata/constraints.txt
+    #   -c testdata/constraints.txt
     #   requests