5229 commits

Author	SHA1	Message	Date
John Mumm	c19a294a48	Add DisplaySafeUrl newtype to prevent leaking of credentials by default (#13560) ... Prior to this PR, there were numerous places where uv would leak credentials in logs. We had a way to mask credentials by calling methods or a recently-added `redact_url` function, but this was not secure by default. There were a number of other types (like `GitUrl`) that would leak credentials on display. This PR adds a `DisplaySafeUrl` newtype to prevent leaking credentials when logging by default. It takes a maximalist approach, replacing the use of `Url` almost everywhere. This includes when first parsing config files, when storing URLs in types like `GitUrl`, and also when storing URLs in types that in practice will never contain credentials (like `DirectorySourceUrl`). The idea is to make it easy for developers to do the right thing and for the compiler to support this (and to minimize ever having to manually convert back and forth). Displaying credentials now requires an active step. Note that despite this maximalist approach, the use of the newtype should be zero cost. One conspicuous place this PR does not use `DisplaySafeUrl` is in the `uv-auth` crate. That would require new clones since there are calls to `request.url()` that return a `&Url`. One option would have been to make `DisplaySafeUrl` wrap a `Cow`, but this would lead to lifetime annotations all over the codebase. I've created a separate PR based on this one (#13576) that updates `uv-auth` to use `DisplaySafeUrl` with one new clone. We can discuss the tradeoffs there. Most of this PR just replaces `Url` with `DisplaySafeUrl`. The core is `uv_redacted/lib.rs`, where the newtype is implemented. To make it easier to review the rest, here are some points of note: * `DisplaySafeUrl` has a `Display` implementation that masks credentials. Currently, it will still display the username when there is both a username and password. If we think is the wrong choice, it can now be changed in one place. * `DisplaySafeUrl` has a `remove_credentials()` method and also a `.to_string_with_credentials()` method. This allows us to use it in a variety of scenarios. * `IndexUrl::redacted()` was renamed to `IndexUrl::removed_credentials()` to make it clearer that we are not masking. * We convert from a `DisplaySafeUrl` to a `Url` when calling `reqwest` methods like `.get()` and `.head()`. * We convert from a `DisplaySafeUrl` to a `Url` when creating a `uv_auth::Index`. That is because, as mentioned above, I will be updating the `uv_auth` crate to use this newtype in a separate PR. * A number of tests (e.g., in `pip_install.rs`) that formerly used filters to mask tokens in the test output no longer need those filters since tokens in URLs are now masked automatically. * The one place we are still knowingly writing credentials to `pyproject.toml` is when a URL with credentials is passed to `uv add` with `--raw`. Since displaying credentials is no longer automatic, I have added a `to_string_with_credentials()` method to the `Pep508Url` trait. This is used when `--raw` is passed. Adding it to that trait is a bit weird, but it's the simplest way to achieve the goal. I'm open to suggestions on how to improve this, but note that because of the way we're using generic bounds, it's not as simple as just creating a separate trait for that method.	2025-05-27 00:05:30 +02:00
Aria Desires	cd8171d2a1	Unwire PackageMetadata fields (#13635) ... PackageMetadata, for whatever reason, does not have a mirrored Wire type so it was easy to not realize that it contains markers that need to be complexified. Fixes #13614 --------- Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>	2025-05-26 14:17:19 -04:00
konsti	6ab1d12480	Avoid rendering info log level (#13642) ... We were previously rendering messages for the info level, carrying overhead in pubgrub which using `log::info!`. We avoid this by only configuring `LevelFilter::INFO` if the durations layer exists. I've confirmed that the default `Subscriber::max_level_hint` goes from `INFO` to `OFF` and the profile skips `Incompatibility::display`.	2025-05-26 15:17:15 +02:00
konsti	a6f8fa7e42	Optimize Version display (#13643) ... We format enough versions that the `.collect::<Vec<String>>()` showed up in profiles.	2025-05-26 15:17:07 +02:00
Jo	bef128892d	Set LC_ALL=C for git when checking git worktree (#13637) ... ## Summary Closes #13612 We check if the git error message includes `not a git repository` to figure out if the path isn't a Git repo or if Git's broken. This PR sets `LC_ALL=C` when invoking `git rev-parse --is-inside-work-tree` so that the error message doesn’t change based on the user’s locale settings.	2025-05-24 11:05:38 -04:00
Aria Desires	0ddcc19055	Bump version to 0.7.8 (#13629)	2025-05-23 19:13:28 -04:00
Aria Desires	b93ce238a0	blocklist the linux cpython builds from 20250517 (#13617) ... There is a runtime issue with some of these builds Here is the testing I've seen (❌ has bug, ✅ works): * uv version (pbs version) * ❌ uv 0.7.7 (pbs 20250521) * ❌ uv 0.7.6 (pbs 20250517) * ✅ uv 0.7.5 (pbs 20250409) * os * ❌ linux * ✅ windows * arch * ❌ x86_64 * ✅ aarch64 * python version * ❌ 3.12 * ❌ 3.13 * ❌ 3.14 Fixes #13610	2025-05-23 18:15:16 -04:00
konsti	67bf3eb96c	Fix tests due to yanked configargparse (#13623) ... The release of configargparse locked in the tests was yanked, we fix this by updating the snapshots.	2025-05-23 18:43:49 +00:00
John Mumm	3758c513a4	Remove misleading line in pin documentation (#13611) ... The documentation did not reflect #12921.	2025-05-23 09:04:50 +02:00
Aria Desires	8580b4bd2d	Bump version to 0.7.7 (#13601)	2025-05-22 14:42:26 -04:00
konsti	46bc7d3477	Build backend: Support stubs packages (#13563) ... Stubs packages are different in that their name ends with `-stubs`, their module is `<module name>-stubs` (with a dash, not the generally legal underscore) and their modules contain a `__init__.pyi` instead of an `__init__.py` (https://typing.python.org/en/latest/spec/distributing.html#stub-only-packages). We add support in the uv build backend by detecting the `-stubs` suffix. Fixes #13546 --------- Co-authored-by: Alex Waygood <Alex.Waygood@Gmail.com>	2025-05-22 19:02:17 +02:00
Geoffrey Thomas	c8479574f2	Sync latest Python releases (#13593) ... Pick up python-build-standalone 20250522, in particular to fix astral-sh/python-build-standalone#619	2025-05-22 09:21:44 -04:00
renovate[bot]	c7cabfccd7	Update markdown to v1 and fix CLI reference links (#13166) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [markdown](https://redirect.github.com/wooorm/markdown-rs) | dependencies | major | `0.3.0` -> `1.0.0` | --- ### Release Notes <details> <summary>wooorm/markdown-rs (markdown)</summary> ### [`v1.0.0`](https://redirect.github.com/wooorm/markdown-rs/releases/tag/1.0.0) 💯 Nothing changed since the last alpha. It’s just that: this crate’s now being used a bunch and working well, so it’s time to be stable! </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: konstin <konstin@mailbox.org>	2025-05-21 22:50:09 +02:00
Michał Górny	dbcfe9f80b	Fix version json tests to work outside git checkout (#13566) ... ## Summary Fix the two version json tests to account for the possibility that uv was built outside a git checkout (e.g. from an unpacked git archive) and therefore does not have the commit info available. This approach uses separate snapshots for the two cases, as suggested in discussion of pull request #13251. Fixes #13212 ## Test Plan 1. `cargo test` in a git clone. 2. `cargo clean`, moved `.git` away, `cargo test` again. --------- Co-authored-by: Aria Desires <aria.desires@gmail.com>	2025-05-21 15:59:39 -04:00
Aria Desires	38884da9b9	make uv version lock and sync (#13317) ... This adopts the logic from `uv remove` for locking and syncing, as the scope of the changes made are ultimately similar. Unlike `uv remove` there is no support for modifying PEP723 scripts, as these are not versioned. In doing this the `version` command gains a truckload of args for configuring lock/sync behaviour. Presumably most of these are passed via settings or env files, and not of particular concern. The most interesting additions are: * `--frozen`: makes `uv version` work ~exactly as it did before this PR * `--locked`: errors if the lockfile is out of date * `--no-sync`: updates the lockfile, but doesn't run the equivalent of `uv sync` * `--package name`: a convenience for referring to a package in the workspace Note that the existing `--dry-run` flag effectively implies `--frozen` for sets and bumps. Fixes #13254 Fixes #13548	2025-05-21 09:46:09 -04:00
konsti	cf27c077be	Remove unnecessary current dir in tests (#13561) ... This is already done by `add_shared_options`.	2025-05-20 21:36:45 +02:00
konsti	bc7b71f269	Platform discovery is using ld.so instead ldd (#13552) ... In platform discovery we're parsing the output of the ELF interpreter, e.g., `/lib64/ld-linux-x86-64.so.2`. This file is ld, not ldd, which was incorrectly named in the code. An alternative is naming everything ELF interpreter instead of ld.so.	2025-05-20 15:27:22 +02:00
Zanie Blue	7f3e94a091	Bump version to 0.7.6 (#13537) ... Co-authored-by: Aria Desires <aria.desires@gmail.com>	2025-05-19 19:46:11 -04:00
konsti	2894721b6e	Use AsyncFn traits for cached client (#13530) ... Make use of the 2024 edition.	2025-05-19 07:49:27 +00:00
samypr100	3483f1d8b3	fix: format uv-trampoline for 2024 edition (#13519) ... ## Summary Follow on to https://github.com/astral-sh/uv/pull/13516 Ensure uv-trampoline is formatted after switching to 2024 edition.	2025-05-18 20:19:27 -04:00
Charlie Marsh	6e05d37a1d	Remove av pin in transformers (#13518) ... ## Summary This test started failing, and it fails at least back to v0.6, so I don't think it's on our end. I'm wondering if all the wheels here were yanked? They're visible in the lockfile, but not on PyPI: https://pypi.org/project/av/9.2.0/#files. So to get this passing, let's just unpin it. Edit: Ahh, ok. It looks like the project ran out of space, so they removed wheels for all the older versions: https://github.com/PyAV-Org/PyAV/issues/1879.	2025-05-18 19:59:34 -04:00
Charlie Marsh	c5032aee80	Bump MSRV to 1.85 and Edition 2024 (#13516) ... ## Summary Builds on https://github.com/astral-sh/uv/pull/11724. Closes https://github.com/astral-sh/uv/issues/13476.	2025-05-18 19:38:43 -04:00
Charlie Marsh	cc6e766232	Update pre-release hint (#13517) ... ## Summary I believe it's a known issue that the "available versions" doesn't respect `--exclude-newer`.	2025-05-18 18:41:18 -04:00
Michał Górny	061751f195	Add missing git feature dep to preserve_executable_bit test (#12850) ... ## Summary Without the `git` feature, it fails with: ``` error: Failed to initialize Git repository at `/home/mgorny/.local/share/uv/tests/.tmp01wGGK/temp/preserve_executable_bit` stdout: stderr: error: `git` operations are not allowed — are you missing a cfg for the `git` feature? ``` ## Test Plan cargo test --features python --profile=fast-build --no-default-features	2025-05-18 17:31:01 -04:00
Charlie Marsh	9904c47daf	Respect default extras in uv remove (#13380) ... ## Summary Using "all extras" in `uv remove` will cause errors for projects with conflicting extras. Now that we have a concept of "default extras", it seems better to respect those defaults like we do for dependency groups. Closes https://github.com/astral-sh/uv/issues/12770.	2025-05-18 17:28:50 -04:00
Zanie Blue	4b7f5f1103	Update Python releases (#13509)	2025-05-17 13:19:20 -05:00
Eric Nielsen	be1404df2a	Fix VIRTUAL_ENV_PROMPT value in activator/activate (#13501) ... ## Summary <!-- What's the purpose of the change? What does it do, and why? --> I've compared all the activator scripts here with the original ones in https://github.com/pypa/virtualenv/tree/main/src/virtualenv/activation and only the bash/POSIX script here was yielding a VIRTUAL_ENV_PROMPT value with parenthesis and a trailing space, which should be part of the shell prompt (PS1 for bash/POSIX) but not of the VIRTUAL_ENV_PROMPT value itself. This fixes that small inconsistency. Fixes #13456 This reverts commit 0ec2d4e434 ## Test Plan <!-- How was it tested? --> I didn't test this locally.	2025-05-17 07:48:09 -04:00
Charlie Marsh	9d1a14e1f9	Bump version to v0.7.5 (#13500)	2025-05-16 20:37:17 -04:00
konsti	5d37c7ecc5	Apply first set of Rustfmt edition 2024 changes (#13478) ... Rustfmt introduces a lot of formatting changes in the 2024 edition. To not break everything all at once, we split out the set of formatting changes compatible with both the 2021 and 2024 edition by first formatting with the 2024 style, and then again with the currently used 2021 style. Notable changes are the formatting of derive macro attributes and lines with overly long strings and adding trailing semicolons after statements consistently.	2025-05-16 20:19:02 -04:00
konsti	b31d08c683	Bump simple cache bucket to v16 (#13498) ... We broke the rkyv deserialization in e70cf25ea7 (diff-348b24d7a84672ab2873833988156191995ff467619a77f548adbd9808549999L30-R41) by placing `.tar.bz2` in the position of `.tar.gz`. We need to invalidate the cache bucket. Fixes #13492	2025-05-16 20:17:23 -04:00
konsti	316439337f	Don't error when the script is too short for the buffer (#13488) ... I hit this error case with a broken wheel.	2025-05-16 20:14:13 -04:00
konsti	77268ee152	Build backend: Case sensitive module discovery (#13468) ... We may run on case-sensitive file systems (Linux, generally) or on case-insensitive file systems (Windows, generally), while modules in Python may be lower or upper case. For robustness over filesystem casing, we require an explicit module name for modules with upper cases. Fixes #13419	2025-05-16 14:25:35 +02:00
konsti	23261b7e2e	Apply some Edition 2024 fixes (#13479) ... Some `ref`-removal and `use<>` fixes for the Rust Edition 2024 migration, which are also compatible with Rust Edition 2021.	2025-05-16 10:34:22 +02:00
Andrew Pollack	0baa376627	cli: adjust grammar in “script not supported” error (#13483) ... Love this tooling! Small adjustment to help on error messaging 🙏 <!-- Thank you for contributing to uv! To help us out with reviewing, please consider the following: - Does this pull request include a summary of the change? (See below.) - Does this pull request include a descriptive title? - Does this pull request include references to any relevant issues? --> ## Summary <!-- What's the purpose of the change? What does it do, and why? --> The previous message was missing the word **“like,”** which made it read a tad awkwardly. This PR inserts the missing word so the error reads naturally: **After:** ``` $ uvx ch1.py error: It looks like you tried to run a Python script at `ch1.py`, which is not supported by `uvx` hint: Use `uv run ch1.py` instead ``` **Before:** ``` $ uvx ch1.py error: It looks you tried to run a Python script at `ch1.py`, which is not supported by `uvx` hint: Use `uv run ch1.py` instead ``` ## Test Plan <!-- How was it tested? --> - `cargo run -- uvx examples/ch1.py` shows the updated message (see “After” above). - `cargo test` passes.	2025-05-16 10:23:30 +02:00
konsti	4aa72089a1	Mask gen as r#gen for the 2024 edition (#13477) ... `gen` is a reserved keyword in Rust 2024. This is a requirement to run `cargo fmt` on the Rust 2024 edition.	2025-05-15 19:21:12 +00:00
Zanie Blue	6fbcd09b5a	Bump version to 0.7.4 (#13473)	2025-05-15 11:08:50 -05:00
Zanie Blue	e92c17881c	Log skip reasons during Python installation key interpreter match checks (#13472) ... Investigating https://github.com/astral-sh/uv/issues/13471	2025-05-15 10:28:01 -05:00
konsti	18a1f0d9db	Build backend: Normalize glob paths (#13465) ... Unlike OS APIs, glob inclusion checks don't work when there are relative path elements such as `./`. We normalize the path before using it for the glob. Fixes #13407	2025-05-15 17:19:02 +02:00
Ahmed Ilyas	7a83f51de2	Reinstall local packages in uv add (#13462) ... ## Summary Closes https://github.com/astral-sh/uv/issues/13388 ## Test Plan `cargo test`	2025-05-15 14:08:54 +00:00
konsti	7261ede004	Refactor build backend testing (#13464) ... This is useful for adding more tests for build backend configuration.	2025-05-15 12:00:02 +00:00
John Mumm	4ea44bec0a	Ensure cached realm credentials are applied if no password is found for index URL (#13463) ... We were not correctly falling back to cached realm credentials when an index URL was provided with only a username. This came up in a [later comment](https://github.com/astral-sh/uv/issues/13443#issuecomment-2881115301) on #13443 where credentials in a pip extra index in `uv.toml` were being ignored when the same URL (but with only a username) was used at the command line for `--extra-index-url`. I've added a test to catch this case. Closes #13443	2025-05-15 13:36:18 +02:00
konsti	12860a9041	Remove extra newline (#13461) ... This left an extra newline the hint, which isn't captured in the snapshot.	2025-05-15 09:30:21 +00:00
Eduardo Rittner Coelho	2d4d93a350	ProgressReporter: align progress bars by largest name length (#13266) ... ## Summary Related to https://github.com/astral-sh/uv/issues/12492 This change makes all progress bars vertically aligned. This is still a WIP and so is not complete, in the current design I store `max_len` in `BarState` and update it on every `on_request_start`, however this is problematic since order matters, and if the largest name is not sent first, the alignment is not complete. To mitigate this we'd probably have to update all previous bars by "iterating" through the `bars` field in `BarState` and update all request bars. Below is an image of what happens when the largest name (`nvidia-cusparselt-cu12`) is not the first (in this case, it was the second to last).  ## Test Plan There are currently no tests, and I'm not sure how to design them since from what I gather the `uv_snapshot` facilities record the final output, not the intermediate stages. --------- Co-authored-by: konstin <konstin@mailbox.org>	2025-05-15 09:32:36 +02:00
Charlie Marsh	b326bb92a0	Retain trailing comments after PEP 723 metadata block (#13460) ... ## Summary Closes https://github.com/astral-sh/uv/issues/13447.	2025-05-14 21:54:20 +00:00
konsti	73cf2b8d59	uv export docs: "export" instead of "install" (#13430) ... Change the two missing places in the `uv export` docs to say "export" instead of "install".	2025-05-13 15:53:10 +02:00
konsti	22b1ed5c5d	Be more precise in unpinned packages warning (#13426) ... Fixes #13424	2025-05-13 07:25:05 +00:00
Charlie Marsh	ca725d08f2	Remove unused source tree variant (#13422) ... ## Summary Perhaps this disappeared when we added support for unnamed requirements?	2025-05-13 07:07:10 +00:00
Charlie Marsh	3b8139526a	Add comma after "i.e." in Conda environment error (#13423)	2025-05-13 03:51:07 +00:00
Charlie Marsh	a179972e2d	Reject pylock.toml in uv add -r (#13421) ... ## Summary This silently fails right now. Closes #13420.	2025-05-13 03:50:01 +00:00
konsti	73d22ac21b	Fix double self-dependency (#13366) ... The fix itself and its documentation live in pubgrub: https://github.com/astral-sh/pubgrub/pull/44 Fixes #13344 --------- Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>	2025-05-13 03:03:44 +00:00