smpy package-update rewrites exact pins (==) to lower bounds (>=) with no opt-out

[antosubash]

Summary

smpy package-update doesn't only change versions — it changes the pin style, rewriting exact pins to lower bounds. That leaves a host looser than the module wheels it depends on, which themselves pin exactly.

Filing this as a design question rather than a defect: the rewrite may well be intentional, in which case an opt-out flag is the ask.

Observed

A workspace with the framework pinned exactly, run with --dry-run:

host/pyproject.toml
 simple_module_hosting: simple_module_hosting==0.0.32 → simple_module_hosting>=0.0.32
 simple_module_branding: simple_module_branding==0.0.32 → simple_module_branding>=0.0.32
 ...
modules/triage/pyproject.toml
 simple_module_core: simple_module_core==0.0.32 → simple_module_core>=0.0.32
 ...
Would update 23 dependency(ies) across 5 file(s).

Workspace-member modules are correctly skipped as local sources, and pointing it at the workspace root discovers every pyproject.toml — that part works well.

The surprise is == → >=. Nothing in --help mentions a constraint-style change:

Update all simple_module_* dependencies to the latest PyPI versions.

Why the loosening is awkward here

The published module wheels pin their framework deps exactly. modules/branding/pyproject.toml at 0.0.32:

dependencies = [
 "simple_module_core==0.0.32",
 "simple_module_db==0.0.32",
 "simple_module_hosting==0.0.32",
 "simple_module_settings==0.0.32",
 "simple_module_file_storage==0.0.32",
]

So after package-update, a host declares >=0.0.32 for packages that branding simultaneously requires at ==0.0.32. Resolution still succeeds, but the effective version is now decided by whichever wheel happens to pin hardest, rather than by the host. For a project whose upgrade rule is "every framework pin moves in lockstep or the resolve fails", that's the one property worth keeping explicit.

There's also a practical asymmetry: the tool is the natural way to discover that a new version exists, but applying it changes a policy the project set deliberately, so it ends up being used with --dry-run only and the edits made by hand.

Ask

Either:

• a flag such as --keep-constraint / --exact that preserves the existing operator and only substitutes the version, or
• make preserving the operator the default and put the loosening behind a flag,

and mention the current behaviour in --help and the CLI docs either way.

If exact pins are considered the wrong choice for a host and >= is the recommendation, that's a fine answer too — it would just be worth stating in the docs, since the wheels model the opposite.

Version

simple_module_cli 0.0.32.