chore: remove stray empty uv.lock

[ryanhayame]

Deletes uv.lock, which was committed by accident in #125 (a media-captions PR) on 2026-06-17.

It is a 3-line stub with zero package entries — it locks nothing:

version = 1
revision = 3
requires-python = ">=3.12"

It also declares requires-python = ">=3.12", contradicting the project's ^3.10. Nothing reads it — no workflow, script, or doc references uv.lock or any uv command. This project is Poetry-managed.

Suspected link to the stuck dependency graph

GitHub has not re-parsed poetry.lock since 2026-06-17, and the timing brackets this file exactly:

time (Jun 17)	commit	result
16:47	#124 changed poetry.lock	parsed OK — still what the dependency graph displays today
18:42	#125 added uv.lock	—
Aug 12	#131 changed poetry.lock	ignored
Aug 18	#145 changed poetry.lock	ignored

uv.lock is the only manifest-like file added in that window.

Consequences visible today: the graph reports pre-June versions (torch 2.7.1, cryptography 46.0.3, gitpython 3.1.45) and is missing wandb, pyarrow, and optuna, which #131 added in August. 62 Dependabot alerts remain open against versions that exist nowhere on main — #145 patched all of them.

This is a timing correlation, not a proven cause. GitHub's supported ecosystems docs do not list uv.lock among Python manifests, so there is no documented mechanism for it to interfere. The deletion is correct housekeeping regardless, and it is the one lever the evidence points at.

How to tell whether this worked

After merging, wait a few minutes for the dependency graph to re-scan, then run:

gh api /repos/Trainy-ai/pluto/dependabot/alerts --paginate \
  --jq '.[] | select(.state=="open") | .number' | wc -l

There are exactly two outcomes, and both are informative:

• Count drops toward 0 → uv.lock was jamming dependency-graph ingestion, and the June timing was the tell. The 62 alerts were phantoms matched against a stale June snapshot, and they clear on their own once the graph re-parses poetry.lock.

• Count stays 62 → the correlation was coincidence. Deleting the file was still worth doing on its own merits, and the stuck graph is a GitHub-side bug. The support ticket is then well-evidenced: poetry.lock was last parsed on Jun 17 2026; subsequent changes in e014ee4 (Aug 12) and 68bb94c (Aug 18) were both ignored; and wandb, pyarrow, and optuna — added to the lockfile by feat(migrate): wandb → Pluto historical data migration #131 in August — are absent from the graph entirely.

Either way, no vulnerable dependency exists on main. Every one of the 62 open alerts was checked against the lockfile actually on main: 0 are still vulnerable, 62 are already patched. This is a reporting problem, not a security exposure.

Scope

Deliberately limited to this single deletion. Touching poetry.lock in the same PR would itself force a re-parse and confound the test — we would not learn which change was responsible.

Separately still outstanding (not fixed here, to keep this clean): poetry.lock contains one markers = "<empty>" entry for nvidia-cusparse, which is not valid PEP 508. Worth cleaning up on its own.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bcf098d5-b7c6-4c16-b28c-c9516741f86d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[asaiacai]

lgtm