`hatch env lock --check` requires lockfiles to contain the latest compatible dependency versions

Description

With Hatch 1.18.0, hatch env lock --check can start failing when a new compatible dependency version is published, even though the repository has not changed.

For example, our environment declares:

[envs.lint]
dependencies = [
  # ...
  "tombi >= 1.4",
]

The committed lockfile contained Tombi 1.4.1 and initially passed the check.

When Tombi 1.5.0 was released, the same checkout started failing:

$ hatch env lock --check
Lockfile is not up to date: pylock.lint.toml

Version 1.4.1 still satisfies the declared constraint, so the lockfile should be considered valid.

New compatible releases should not invalidate an existing lockfile. Upgrading locked dependencies should require an explicit operation such as hatch env lock --upgrade.

Current implementation

The relevant Hatch 1.18.0 implementation is UvLocker.in_sync.

It generates a fresh temporary lockfile and compares its complete contents with the existing lockfile.

Rather than only checking whether the locked versions still satisfy the declared constraints, this comparison requires the lockfile to match a fresh resolution using the latest compatible dependency versions available at check time.

Comparison with other tools

The documentation of uv lock --check explicitly states:

uv will not consider lockfiles outdated when new versions of packages are released.