Migrate from urlencoding to percent-encoding (#11144)

## Summary

This lets us drop a dependency entirely. `percent-encoding` is used by
`url` and so is already in the graph, whereas `urlencoding` isn't used
by anything else.

crates/uv-auth/Cargo.toml

@@ -11,12 +11,14 @@ workspace = true
 
 [dependencies]
 uv-once-map = { workspace = true }
+uv-static = { workspace = true }
 
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 base64 = { workspace = true }
 futures = { workspace = true }
 http = { workspace = true }
+percent-encoding = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }
 rust-netrc = { workspace = true }
@@ -24,13 +26,10 @@ rustc-hash = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
 url = { workspace = true }
-urlencoding = { workspace = true }
-
-uv-static = { workspace = true }
 
 [dev-dependencies]
+insta = { version = "1.40.0" }
 tempfile = { workspace = true }
+test-log = { version = "0.2.16", features = ["trace"], default-features = false }
 tokio = { workspace = true }
 wiremock = { workspace = true }
-insta = { version = "1.40.0" }
-test-log = { version = "0.2.16", features = ["trace"], default-features = false }

crates/uv-auth/src/credentials.rs

@@ -127,14 +127,16 @@ impl Credentials {
                 None
             } else {
                 Some(
-                    urlencoding::decode(url.username())
+                    percent_encoding::percent_decode_str(url.username())
+                        .decode_utf8()
                         .expect("An encoded username should always decode")
                         .into_owned(),
                 )
             }
             .into(),
             password: url.password().map(|password| {
-                urlencoding::decode(password)
+                percent_encoding::percent_decode_str(password)
+                    .decode_utf8()
                     .expect("An encoded password should always decode")
                     .into_owned()
             }),

crates/uv-cache-key/Cargo.toml

@@ -19,6 +19,6 @@ workspace = true
 [dependencies]
 hex = { workspace = true }
 memchr = { workspace = true }
+percent-encoding = { workspace = true }
 seahash = { workspace = true }
 url = { workspace = true }
-urlencoding = { workspace = true }

crates/uv-cache-key/src/canonical_url.rs

@@ -78,7 +78,8 @@ impl CanonicalUrl {
                 .path_segments()
                 .unwrap()
                 .map(|segment| {
-                    urlencoding::decode(segment)
+                    percent_encoding::percent_decode_str(segment)
+                        .decode_utf8()
                         .unwrap_or(Cow::Borrowed(segment))
                         .into_owned()
                 })

crates/uv-client/Cargo.toml

@@ -38,6 +38,7 @@ html-escape = { workspace = true }
 http = { workspace = true }
 itertools = { workspace = true }
 jiff = { workspace = true }
+percent-encoding = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }
 reqwest-retry = { workspace = true }
@@ -52,7 +53,6 @@ tokio = { workspace = true }
 tokio-util = { workspace = true }
 tracing = { workspace = true }
 url = { workspace = true }
-urlencoding = { workspace = true }
 
 [dev-dependencies]
 anyhow = { workspace = true }

crates/uv-client/src/html.rs

@@ -93,7 +93,7 @@ impl SimpleHtml {
         // Extract the hash, which should be in the fragment.
         let decoded = html_escape::decode_html_entities(href);
         let (path, hashes) = if let Some((path, fragment)) = decoded.split_once('#') {
-            let fragment = urlencoding::decode(fragment)?;
+            let fragment = percent_encoding::percent_decode_str(fragment).decode_utf8()?;
             (
                 path,
                 if fragment.trim().is_empty() {
@@ -131,7 +131,8 @@ impl SimpleHtml {
         let filename = filename.split('?').next().unwrap_or(filename);
 
         // Unquote the filename.
-        let filename = urlencoding::decode(filename)
+        let filename = percent_encoding::percent_decode_str(filename)
+            .decode_utf8()
             .map_err(|_| Error::UnsupportedFilename(filename.to_string()))?;
 
         // Extract the `requires-python` value, which should be set on the

crates/uv-distribution-types/Cargo.toml

@@ -34,6 +34,7 @@ fs-err = { workspace = true }
 itertools = { workspace = true }
 jiff = { workspace = true }
 owo-colors = { workspace = true }
+percent-encoding = { workspace = true }
 petgraph = { workspace = true }
 rkyv = { workspace = true }
 rustc-hash = { workspace = true }
@@ -43,5 +44,4 @@ serde_json = { workspace = true }
 thiserror = { workspace = true }
 tracing = { workspace = true }
 url = { workspace = true }
-urlencoding = { workspace = true }
 version-ranges = { workspace = true }

crates/uv-distribution-types/src/error.rs

@@ -8,7 +8,7 @@ pub enum Error {
     Io(#[from] std::io::Error),
 
     #[error(transparent)]
-    Utf8(#[from] std::string::FromUtf8Error),
+    Utf8(#[from] std::str::Utf8Error),
 
     #[error(transparent)]
     WheelFilename(#[from] uv_distribution_filename::WheelFilenameError),

crates/uv-distribution-types/src/lib.rs

@@ -923,7 +923,7 @@ impl RemoteSource for Url {
         let last = path_segments.last().expect("path segments is non-empty");
 
         // Decode the filename, which may be percent-encoded.
-        let filename = urlencoding::decode(last)?;
+        let filename = percent_encoding::percent_decode_str(last).decode_utf8()?;
 
         Ok(filename)
     }
@@ -943,7 +943,7 @@ impl RemoteSource for UrlString {
             .ok_or_else(|| Error::MissingPathSegments(self.to_string()))?;
 
         // Decode the filename, which may be percent-encoded.
-        let filename = urlencoding::decode(last)?;
+        let filename = percent_encoding::percent_decode_str(last).decode_utf8()?;
 
         Ok(filename)
     }

crates/uv-fs/Cargo.toml

@@ -16,7 +16,6 @@ doctest = false
 workspace = true
 
 [dependencies]
-
 cachedir = { workspace = true }
 dunce = { workspace = true }
 either = { workspace = true }
@@ -24,12 +23,12 @@ encoding_rs_io = { workspace = true }
 fs-err = { workspace = true }
 fs2 = { workspace = true }
 path-slash = { workspace = true }
+percent-encoding = { workspace = true }
 schemars = { workspace = true, optional = true }
 serde = { workspace = true, optional = true }
-tokio = { workspace = true, optional = true}
 tempfile = { workspace = true }
+tokio = { workspace = true, optional = true}
 tracing = { workspace = true }
-urlencoding = { workspace = true }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 winsafe = { workspace = true }

crates/uv-fs/src/path.rs

@@ -139,7 +139,9 @@ impl<T: AsRef<Path>> PythonExt for T {
 /// On other platforms, this is a no-op.
 pub fn normalize_url_path(path: &str) -> Cow<'_, str> {
     // Apply percent-decoding to the URL.
-    let path = urlencoding::decode(path).unwrap_or(Cow::Borrowed(path));
+    let path = percent_encoding::percent_decode_str(path)
+        .decode_utf8()
+        .unwrap_or(Cow::Borrowed(path));
 
     // Return the path.
     if cfg!(windows) {