Spliting the pylock.toml results in only the last wheels being recorded

[sjmonson]

Describe the bug

When using a pylock as the native lockfile, attempting to write a split lock will result in only last written wheels being populated in the lockfile. For example, running:

pdm lock --platform manylinux_2_34_x86_64 --python "~=3.12"
pdm lock --platform macos_arm64 --python "~=3.12" --append
pdm lock --platform manylinux_2_34_x86_64 --python "<3.12" --append
pdm lock --platform macos_arm64 --python "<3.12" --append

on a project including pytorch-cpu will result in a torch lock of:

[[packages]]
name = "torch"
version = "2.9.0+cpu"
requires-python = ">=3.10"
wheels = [
    {name = "torch-2.9.0-cp311-none-macosx_11_0_arm64.whl",url = "https://download.pytorch.org/whl/cpu/torch-2.9.0-cp311-none-macosx_11_0_arm64.whl",hashes = {sha256 = "aa4483602586cc9a35d1cf33771a9977f0
5f642b9161518a289e36548a0b77c2"}},
    {name = "torch-2.9.0-cp310-none-macosx_11_0_arm64.whl",url = "https://download.pytorch.org/whl/cpu/torch-2.9.0-cp310-none-macosx_11_0_arm64.whl",hashes = {sha256 = "59484193b01299bf669520505a72b29d59
a0028ae4c6d95f492938f186592208"}},
]

To reproduce

1. Create a pyproject with something like:

[[tool.pdm.source]]
name = "torch"
type = "find_links"
#url = "https://download.pytorch.org/whl/cpu/torch_stable.html"
url = "https://download.pytorch.org/whl/cpu/torch/"
include_packages = ["torch"]

[project]
requires-python = ">=3.10.0,<4.0"
dependencies = [
    "torch==2.9.*",
]

2. Run all lock stages:

pdm lock --platform manylinux_2_34_x86_64 --python "~=3.12"
pdm lock --platform macos_arm64 --python "~=3.12" --append
pdm lock --platform manylinux_2_34_x86_64 --python "<3.12" --append
pdm lock --platform macos_arm64 --python "<3.12" --append

3. Attempt to install package to new venv:

# On linux `python <3.12,>=3.10`, linux `python >=3.12`, or MacOS `python >=3.12`
pdm install -p ./ -G all --check --prod --no-editable

Expected Behavior

Wheels section should include wheels for all possible versions.

Environment Information

PDM version:
  2.26.2
Python Interpreter:
  <workdir>/.venv/bin/python (3.13)
Project Root:
  <workdir>
Local Packages:
  <workdir>/.venv/lib/python3.13/site-packages
{
  "implementation_name": "cpython",
  "implementation_version": "3.13.9",
  "os_name": "posix",
  "platform_machine": "x86_64",
  "platform_release": "6.17.8-300.fc43.x86_64",
  "platform_system": "Linux",
  "platform_version": "#1 SMP PREEMPT_DYNAMIC Fri Nov 14 01:47:12 UTC 2025",
  "python_full_version": "3.13.9",
  "platform_python_implementation": "CPython",
  "python_version": "3.13",
  "sys_platform": "linux"
}

Verbose Command Output

No response

Additional Context

No response

Are you willing to submit a PR to fix this bug?

• Yes, I would like to submit a PR.

[frostming]

I’m having trouble reproducing this issue. Can you reproduce it using the numpy package from pypi.org?

We do have a check to clear existing hashes, but only when they lack a URL key:

pdm/src/pdm/formats/pylock.py

Lines 100 to 102 in a7bd243

	if all("url" in hash_item for hash_item in hashes):
	continue
	package.candidate.hashes.clear()