astral-sh/uv · error

Cannot specify additional requirements alongside a `pylock.t

Error message

Cannot specify additional requirements alongside a `pylock.toml` file

What it means

Thrown in RequirementsSpecification::from_sources (crates/uv-requirements/src/specification.rs:473) when the requirements list mixes a PylockToml source with any non-pylock source. A pylock.toml is a fully-resolved lock: uv installs exactly what it contains, so extra requirements alongside it are contradictory and rejected before resolution.

Source

Thrown at crates/uv-requirements/src/specification.rs:473

                "Cannot use `{}` as an exclude file",
                pylock_toml.user_display()
            ));
        }

        // If we have a `pylock.toml`, don't allow additional requirements, constraints, or
        // overrides.
        if let Some(pylock_toml) = requirements.iter().find_map(|source| {
            if let RequirementsSource::PylockToml(path) = source {
                Some(path)
            } else {
                None
            }
        }) {
            if requirements
                .iter()
                .any(|source| !matches!(source, RequirementsSource::PylockToml(..)))
            {
                return Err(anyhow::anyhow!(
                    "Cannot specify additional requirements alongside a `pylock.toml` file",
                ));
            }
            if !constraints.is_empty() {
                return Err(anyhow::anyhow!(
                    "Cannot specify constraints with a `pylock.toml` file"
                ));
            }
            if !overrides.is_empty() {
                return Err(anyhow::anyhow!(
                    "Cannot specify overrides with a `pylock.toml` file"
                ));
            }

            // If we have a `pylock.toml`, disallow specifying paths for groups; instead, require
            // that all groups refer to the `pylock.toml` file.
            if let Some(groups) = groups {
                let mut names = Vec::new();

View on GitHub (pinned to f1a42680ff)

Solutions

1. Remove the extra requirements/packages from the command and install from the lock alone
2. Or regenerate the lock including the new package, then install from the updated pylock.toml
3. If you need a superset, layer with constraints (a requirements.txt pin file) rather than adding requirements next to the lock — but see error 57: constraints are also disallowed, so the lock must be edited

Example fix

# before
uv pip install -r pylock.toml flask
# after
# add flask to the source project, re-export, then:
uv pip install -r pylock.toml

let has_pylock = requirements.iter().any(|s| matches!(s, RequirementsSource::PylockToml(_)));
let has_other = requirements.iter().any(|s| !matches!(s, RequirementsSource::PylockToml(_)));
if has_pylock && has_other {
    return Err(anyhow::anyhow!("pylock.toml must be the sole requirements source"));
}

fn is_pylock_source(s: &RequirementsSource) -> bool {
    matches!(s, RequirementsSource::PylockToml(_))
}

match RequirementsSpecification::from_sources(requirements, /* .. */).await {
    Err(err) if err.to_string().contains("additional requirements alongside") => {
        // drop extras, regenerate the lock, and retry
    }
    spec => spec?,
}

When it happens

Trigger: `uv pip install -r pylock.toml flask` (a second -r file, a positional package, an --editable, etc. next to the lock); programmatically, requirements containing both PylockToml and any other variant.

Common situations: Users adding one ad-hoc package to a locked invocation; CI templates that append `--requirement pylock.toml` to commands that already carry packages; migrating scripts incrementally to locks.

Related errors

• Cannot specify constraints with a `pylock.toml` file
• Cannot specify overrides with a `pylock.toml` file
• Cannot specify paths for groups with a `pylock.toml` file; a
• The file `{}` appears to be a `pylock.toml` file, but constr
• The file `{}` appears to be a `pylock.toml` file, but overri

AI-assisted analysis of astral-sh/uv@f1a42680ff (2026-08-16). Data as JSON: /api/errors/642f84e15a68f7d2. Report an issue: GitHub.