236 commits

Author	SHA1	Message	Date
konsti	0cee76417f	Bump version to 0.9.18 (#17141) ... It's been a week. --------- Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-12-16 13:32:35 +00:00
Zanie Blue	2b5d65e61d	Bump version to 0.9.17 (#17058)	2025-12-09 16:36:00 -06:00
Zanie Blue	a63e5b62e3	Bump version to 0.9.16 (#17008)	2025-12-06 07:52:06 -06:00
Zanie Blue	f6ad3dcd57	Regenerate the crates.io readmes on release (#16992) ... Otherwise, they're stale!	2025-12-04 19:19:36 -06:00
Zanie Blue	e7af5838bb	Bump version to 0.9.15 (#16942)	2025-12-02 17:48:28 -06:00
Zanie Blue	99c40f74c5	Link to the uv version in crates.io member READMEs (#16939) ... Closes https://github.com/astral-sh/uv/issues/16931	2025-12-02 20:02:22 +00:00
samypr100	fee7f9d093	Support Git LFS with opt-in (#16143) ... ## Summary Follow up to https://github.com/astral-sh/uv/pull/15563 Closes https://github.com/astral-sh/uv/issues/13485 This is a first-pass at adding support for conditional support for Git LFS between git sources, initial feedback welcome. e.g. ``` [tool.uv.sources] test-lfs-repo = { git = "https://github.com/zanieb/test-lfs-repo.git", lfs = true } ``` For context previously a user had to set `UV_GIT_LFS` to have uv fetch lfs objects on git sources. This env var was all or nothing, meaning you must always have it set to get consistent behavior and it applied to all git sources. If you fetched lfs objects at a revision and then turned off lfs (or vice versa), the git db, corresponding checkout lfs artifacts would not be updated properly. Similarly, when git source distributions were built, there would be no distinction between sources with lfs and without lfs. Hence, it could corrupt the git, sdist, and archive caches. In order to support some sources being LFS enabled and other not, this PR adds a stateful layer roughly similar to how `subdirectory` works but for `lfs` since the git database, the checkouts and the corresponding caching layers needed to be LFS aware (requested vs installed). The caches also had to isolated and treated entirely separate when handling LFS sources. Summary * Adds `lfs = true` or `lfs = false` to git sources in pyproject.toml * Added `lfs=true` query param / fragments to most relevant url structs (not parsed as user input) * In the case of uv add / uv tool, `--lfs` is supported instead * `UV_GIT_LFS` environment variable support is still functional for non-project entrypoints (e.g. uv pip) * `direct-url.json` now has an custom `git_lfs` entry under VcsInfo (note, this is not in the spec currently -- see caveats). * git database and checkouts have an different cache key as the sources should be treated effectively different for the same rev. * sdists cache also differ in the cache key of a built distribution if it was built using LFS enabled revisions to distinguish between non-LFS same revisions. This ensures the strong assumption for archive-v0 that an unpacked revision "doesn't change sources" stays valid. Caveats * `pylock.toml` import support has not been added via git_lfs=true, going through the spec it wasn't clear to me it's something we'd support outside of the env var (for now). * direct-url struct was modified by adding a non-standard `git_lfs` field under VcsInfo which may be undersirable although the PEP 610 does say `Additional fields that would be necessary to support such VCS SHOULD be prefixed with the VCS command name` which could be interpret this change as ok. * There will be a slight lockfile and cache churn for users that use `UV_GIT_LFS` as all git lockfile entries will get a `lfs=true` fragment. The cache version does not need an update, but LFS sources will get their own namespace under git-v0 and sdist-v9/git hence a cache-miss will occur once but this can be sufficient to label this as breaking for workflows always setting `UV_GIT_LFS`. ## Test Plan Some initial tests were added. More tests likely to follow as we reach consensus on a final approach. For IT test, we may want to move to use a repo under astral namespace in order to test lfs functionality. Manual testing was done for common pathological cases like killing LFS fetch mid-way, uninstalling LFS after installing an sdist with it and reinstalling, fetching LFS artifacts in different commits, etc. PSA: Please ignore the docker build failures as its related to depot OIDC issues. --------- Co-authored-by: Zanie Blue <contact@zanie.dev> Co-authored-by: konstin <konstin@mailbox.org>	2025-12-02 12:23:51 +00:00
Zsolt Dollenstein	05814f9cd5	Bump version to 0.9.14 (#16909)	2025-12-01 11:52:15 -05:00
Zanie Blue	735b87004c	Bump version to 0.9.13 (#16862)	2025-11-26 15:12:54 +00:00
Zanie Blue	17c1061676	Fix the links to uv in crates.io member READMEs (#16848)	2025-11-25 18:47:32 +00:00
Zanie Blue	0fb1233363	Bump version to 0.9.12 (#16840)	2025-11-24 23:22:12 +00:00
Zanie Blue	7b8240dca9	Generate a README for crate members too (#16812) ... We skip members with existing READMEs for now. Follows #16809 and #16811	2025-11-21 15:44:05 -06:00
Zanie Blue	1de0cbea94	Use the word "internal" in crate descriptions (#16810) ... ref https://github.com/astral-sh/uv/pull/16809#pullrequestreview-3494007588	2025-11-21 13:22:47 -06:00
Zanie Blue	563438f13d	Fix documentation links for crates (#16801) ... Part of https://github.com/astral-sh/uv/issues/4392 We shouldn't link to PyPI, and dropping the workspace-level documentation link should mean that we get the auto-generated `docs.rs` links.	2025-11-21 10:44:58 -06:00
Zanie Blue	dfe89047bb	Publish to crates.io (#16770)	2025-11-20 21:26:44 +00:00
samypr100	7978122837	Update Rust toolchain to 1.91 and MSRV to 1.89 (#16531) ... ## Summary Updates Rust Toolchain to [1.91](https://blog.rust-lang.org/2025/10/30/Rust-1.91.0/) and bumps MSRV to [1.89](https://blog.rust-lang.org/2025/08/07/Rust-1.89.0/) per versioning policy. New clippy rule [implicit clone](https://rust-lang.github.io/rust-clippy/master/index.html#implicit_clone) resulted in some minor changes (some with improvements). Updates trampoline to `nightly-2025-06-23` which is roughly 1.89~. The trampoline binaries do not need to be regenerated as there should be no changes.	2025-10-30 22:34:59 -05:00
Charlie Marsh	dea1700945	Avoid ANSI codes in debug! messages (#15843) ... ## Summary I spent time trying to figure out how to support this but came up empty. It _seems_ like maybe the `DefaultFields` implementation in `tracing-subscriber` uses debug formatting for fields...? So if you have a string with ANSI codes, they end up printing as unformatted values? I even reverted all our custom formatting in `logging.rs` and saw the same thing. Closes https://github.com/astral-sh/uv/issues/15840.	2025-09-17 14:30:43 +00:00
chisato	accfb48876	Fix uv sync --no-sources not switching from editable to registry installations (#15234) ... ## Summary Fixes issue #15190 where `uv sync --no-sources` fails to switch from editable to registry package installations. The problem occurred because the installer's satisfaction check didn't consider the `--no-sources` flag when determining if an existing editable installation was compatible with a registry requirement. ## Solution Modified `RequirementSatisfaction::check()` to reject non-registry installations when `SourceStrategy::Disabled` and the requirement is from registry. Added `SourceStrategy` parameter threading through the entire call chain from commands to the satisfaction check to ensure consistent behavior between `uv sync --no-sources` and `uv pip install --no-sources`. --------- Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>	2025-09-17 06:35:32 -05:00
Zanie Blue	50bfa8a689	Add logging of incompatible tags on satisfies check (#15663) ... I was trying to understand https://github.com/astral-sh/uv/issues/9559 and think we need more logs to see what's going on.	2025-09-03 11:45:49 -05:00
Charlie Marsh	4168d9b320	Add --python-platform to uv run and uv tool (#15515) ... ## Summary Closes https://github.com/astral-sh/uv/issues/11120.	2025-08-29 00:51:39 +00:00
Charlie Marsh	ef9a332364	Cache WHEEL and METADATA reads in installed distributions (#15489) ... ## Summary Uses interior mutability to cache the reads. This follows the pattern we use for reading the platform tags in `Interpreter::tags`.	2025-08-25 13:40:20 +00:00
Charlie Marsh	be4d5b72aa	Reject already-installed wheels that don't match the target platform (#15484) ... ## Summary We've received several requests to validate that installed wheels match the current Python platform. This isn't _super_ common, since it requires that your platform changes in some meaningful way (e.g., you switch from x86 to ARM), though in practice, it sounds like it _can_ happen in HPC environments. This seems like a good thing to do regardless, so we now validate that the tags (as recoded in `WHEEL`) are consistent with the current platform during installs. Closes https://github.com/astral-sh/uv/issues/15035.	2025-08-25 09:20:54 -04:00
Charlie Marsh	ac84f5aedc	Move preview features into a dedicated crate (#15482) ... ## Summary This is causing some cyclic dependencies issues for me, because these can be used in virtually _any_ crate (like `uv-install-wheel`), which then means that all of `uv-configuration` becomes a dependency, etc. I think this should be a leaf crate so that we can safely depend on it anywhere.	2025-08-24 09:55:30 -04:00
Charlie Marsh	35a8dd514e	Import PackageName from uv-normalize (#15439) ... ## Summary This might be unintentional? `PackageName` is re-exported from `uv-pep508`, so some crates import it from there.	2025-08-21 23:15:40 +00:00
Charlie Marsh	08233c2ac7	Avoid panicking when resolver returns stale distributions (#15389) ... ## Summary I've written a reasonably-long comment to explain what's going on here. We should fix this, but it's better to continue using a potentially-stale distribution than to panic. Closes https://github.com/astral-sh/uv/issues/15386. --------- Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-08-20 14:04:39 +00:00
Charlie Marsh	7ba6d50767	Install non-build-isolation packages in a second phase (#15306) ... ## Summary This PR productionizes an idea I saw in https://github.com/astral-sh/uv/issues/15248, which was added in Pixi: https://github.com/prefix-dev/pixi/pull/4247. The core of the idea is that if we install all build isolation-enabled packages first, and the build isolation-disabled packages in a second phase, the sync is more likely to "just work", because if all the build dependencies of the build isolation-disabled packages are included as dependencies (as is the case for `flash-attn`, at least), they'll be present. This isn't really a silver bullet, because it requires that all the build dependencies are included as first-party dependencies, and if you have packages that want build isolation to be disabled but rely on other packages that also require build isolation disabled, that won't work either. I think `extra-build-dependencies` will be more robust and have much better caching behavior, but this will get more cases right than our current behavior, and I don't see any downsides. Closes https://github.com/astral-sh/uv/issues/15301.	2025-08-15 22:00:55 +00:00
Charlie Marsh	58c7cc0e0f	Reject already-installed wheels built with outdated settings (#15289) ... ## Summary With this PR, we track the settings that were used to build a wheel (`--config-settings`, plus any `extra-build-dependencies` or `extra-build-variables`) and write those to the `.dist-info` directory upon install. This then allows us to "reject" already-installed wheels, if the user changes the build dependencies or `--config-settings` (or, crucially, if they use `match-runtime = true` and the resolution changes). Closes https://github.com/astral-sh/uv/issues/15218.	2025-08-15 15:15:55 +00:00
Charlie Marsh	d75ab0c316	Avoid &String in installer (#15299) ... ## Summary Not sure why this is here.	2025-08-15 11:05:11 +01:00
Charlie Marsh	bcfa8443da	Rename InstalledDist methods to reflect read operation (#15290) ... ## Summary I found it surprising that these don't "just" return fields from the struct.	2025-08-14 22:39:40 +01:00
Charlie Marsh	82d5b6780a	Move --config-settings structs into uv-distribution-types (#15278) ... ## Summary This breaks up a cycle I'm running into in incorporating the build configuration into our cache keys. This is actually a type that ends up in the frontend build system, etc., so I think it makes more sense here anyway (as opposed to `uv-configuration` which tend to be our own user-facing types).	2025-08-14 15:07:47 +01:00
Zanie Blue	b8049eaa20	Move warnings for conflicting modules into preview (#15253)	2025-08-13 19:39:09 +00:00
samypr100	323aa8f332	chore(🧹): cleanup env var usage (#15247) ... ## Summary Split the cleanup fixes from https://github.com/astral-sh/uv/pull/15196 into a separate PR for easier review. This cleans up some minor env var usage / references throughout tests and runtime code. ## Test Plan Existing Tests. No functional changes.	2025-08-12 21:11:28 -05:00
Charlie Marsh	40b894bb1d	Include build settings in cache key for registry source distribution lookups (#15225) ... ## Summary Like #15030, but for source distributions built from a registry.	2025-08-11 22:14:27 +01:00
Charlie Marsh	3c1844ca4a	Add support for per-project build-time environment variables (#15095) ... ## Summary E.g., you can now do: ```toml [tool.uv.extra-build-variables] flash-attn = { FLASH_ATTENTION_SKIP_CUDA_BUILD = "TRUE" } ```	2025-08-06 18:01:55 -05:00
Charlie Marsh	c77cb2023f	Show wheel tag hints in install plan (#15066) ... ## Summary If we fail to install a wheel in `uv pip install` that's provided via direct URL, we should explain why, just like in the lockfile.	2025-08-04 23:43:33 +00:00
Charlie Marsh	a28c3fb7d9	Preserve lowered extra build dependencies (#15038) ... ## Summary I should've noticed this during review -- my bad -- but it looks like after lowering, we're converting back to `uv_pep508::Requirement`. This is mostly okay, but it's lossy for some lowerings. For example, we lose index pinning. With this PR, we now preserve the lowered types (`Requirement`). Closes https://github.com/astral-sh/uv/issues/15037.	2025-08-04 22:42:11 +01:00
Charlie Marsh	3a7aeff86f	Respect extra build requires when reading from wheel cache (#15030) ... ## Summary We weren't including these in the cache key when constructing the install plan. We likely still read them from the cache later, but we may have reported the wrong number of prepares, etc.	2025-08-02 19:26:02 +00:00
Zanie Blue	7b8dd5cfaf	Run cargo update (#14899)	2025-07-25 15:19:38 -05:00
Charlie Marsh	e724ddc63f	Allow --config-settings-package to apply configuration settings at the package level (#14573) ... ## Summary Closes https://github.com/astral-sh/uv/issues/14564. Closes https://github.com/astral-sh/uv/issues/10940.	2025-07-17 21:27:54 -04:00
Charlie Marsh	dff9ced40a	Support conflicting editable settings across groups (#14197) ... If a user specifies `-e /path/to/dir` and `/path/to/dir` in a `uv pip install` command, we want the editable to "win" (rather than erroring due to conflicting URLs). Unfortunately, this behavior meant that when you requested a package as editable and non-editable in conflicting groups, the editable version was _always_ used. This PR modifies the requisite types to use `Option<bool>` rather than `bool` for the `editable` field, so we can determine whether a requirement was explicitly requested as editable, explicitly requested as non-editable, or not specified (as in the case of `/path/to/dir` in a `requirements.txt` file). In the latter case, we allow editables to override the "unspecified" requirement. If a project includes a path dependency twice, once with `editable = true` and once without any `editable` annotation, those are now considered conflicting URLs, and lead to an error, so I've marked this change as breaking. Closes https://github.com/astral-sh/uv/issues/14139.	2025-07-17 17:20:21 -05:00
adisbladis	3884ab5715	Fix bytecode compilation debug message introduced by #14369 (#14682) ... ## Summary When refactoring the addition PR I accidentally introduced a bug where the debug message would not be output if the default value is used. cc @zanieb	2025-07-17 13:35:25 +00:00
adisbladis	bdb8c2646a	Add UV_COMPILE_BYTECODE_TIMEOUT environment variable (#14369) ... ## Summary When installing packages on _very_ slow/overloaded systems it'spossible to trigger bytecode compilation timeouts, which tends to happen in environments such as Qemu (especially without KVM/virtio), but also on systems that are simply overloaded. I've seen this in my Nix builds if I for example am compiling a Linux kernel at the same time as a few other concurrent builds. By making the bytecode compilation timeout adjustable you can work around such issues. I plan to set `UV_COMPILE_BYTECODE_TIMEOUT=0` in the [pyproject.nix builders](https://pyproject-nix.github.io/pyproject.nix/build.html) to make them more reliable. - Related issues * https://github.com/astral-sh/uv/issues/6105 ## Test Plan Only manual testing was applied in this instance. There is no existing automated tests for bytecode compilation timeout afaict.	2025-07-17 08:11:32 -05:00
John Mumm	c19a294a48	Add DisplaySafeUrl newtype to prevent leaking of credentials by default (#13560) ... Prior to this PR, there were numerous places where uv would leak credentials in logs. We had a way to mask credentials by calling methods or a recently-added `redact_url` function, but this was not secure by default. There were a number of other types (like `GitUrl`) that would leak credentials on display. This PR adds a `DisplaySafeUrl` newtype to prevent leaking credentials when logging by default. It takes a maximalist approach, replacing the use of `Url` almost everywhere. This includes when first parsing config files, when storing URLs in types like `GitUrl`, and also when storing URLs in types that in practice will never contain credentials (like `DirectorySourceUrl`). The idea is to make it easy for developers to do the right thing and for the compiler to support this (and to minimize ever having to manually convert back and forth). Displaying credentials now requires an active step. Note that despite this maximalist approach, the use of the newtype should be zero cost. One conspicuous place this PR does not use `DisplaySafeUrl` is in the `uv-auth` crate. That would require new clones since there are calls to `request.url()` that return a `&Url`. One option would have been to make `DisplaySafeUrl` wrap a `Cow`, but this would lead to lifetime annotations all over the codebase. I've created a separate PR based on this one (#13576) that updates `uv-auth` to use `DisplaySafeUrl` with one new clone. We can discuss the tradeoffs there. Most of this PR just replaces `Url` with `DisplaySafeUrl`. The core is `uv_redacted/lib.rs`, where the newtype is implemented. To make it easier to review the rest, here are some points of note: * `DisplaySafeUrl` has a `Display` implementation that masks credentials. Currently, it will still display the username when there is both a username and password. If we think is the wrong choice, it can now be changed in one place. * `DisplaySafeUrl` has a `remove_credentials()` method and also a `.to_string_with_credentials()` method. This allows us to use it in a variety of scenarios. * `IndexUrl::redacted()` was renamed to `IndexUrl::removed_credentials()` to make it clearer that we are not masking. * We convert from a `DisplaySafeUrl` to a `Url` when calling `reqwest` methods like `.get()` and `.head()`. * We convert from a `DisplaySafeUrl` to a `Url` when creating a `uv_auth::Index`. That is because, as mentioned above, I will be updating the `uv_auth` crate to use this newtype in a separate PR. * A number of tests (e.g., in `pip_install.rs`) that formerly used filters to mask tokens in the test output no longer need those filters since tokens in URLs are now masked automatically. * The one place we are still knowingly writing credentials to `pyproject.toml` is when a URL with credentials is passed to `uv add` with `--raw`. Since displaying credentials is no longer automatic, I have added a `to_string_with_credentials()` method to the `Pep508Url` trait. This is used when `--raw` is passed. Adding it to that trait is a bit weird, but it's the simplest way to achieve the goal. I'm open to suggestions on how to improve this, but note that because of the way we're using generic bounds, it's not as simple as just creating a separate trait for that method.	2025-05-27 00:05:30 +02:00
Charlie Marsh	c5032aee80	Bump MSRV to 1.85 and Edition 2024 (#13516) ... ## Summary Builds on https://github.com/astral-sh/uv/pull/11724. Closes https://github.com/astral-sh/uv/issues/13476.	2025-05-18 19:38:43 -04:00
konsti	5d37c7ecc5	Apply first set of Rustfmt edition 2024 changes (#13478) ... Rustfmt introduces a lot of formatting changes in the 2024 edition. To not break everything all at once, we split out the set of formatting changes compatible with both the 2021 and 2024 edition by first formatting with the 2024 style, and then again with the currently used 2021 style. Notable changes are the formatting of derive macro attributes and lines with overly long strings and adding trailing semicolons after statements consistently.	2025-05-16 20:19:02 -04:00
konsti	1afadda819	Add more context to errors in high level crates. (#13351) ... Add error context in some places where it was previously missing, and a few style improvements.	2025-05-12 11:04:41 +00:00
Charlie Marsh	6eb6475afd	Add subdirectory to Direct URL for local directories (#12971) ... ## Summary This is allowed by the spec, even though we don't have a use for it.	2025-04-18 11:57:58 -04:00
Charlie Marsh	42dcea0ee2	Bump MSRV to 1.84 (#12670) ... ## Summary Closes https://github.com/astral-sh/uv/issues/12649.	2025-04-04 11:49:26 -04:00
Charlie Marsh	e4c98e976f	Use Box<Path> in lieu of PathBuf for immutable structs (#12346) ... ## Summary I don't know if I actually want to commit this, but I did it on the plane last time and just polished it off (got it to compile) while waiting to board.	2025-03-25 21:56:06 +00:00
Charlie Marsh	46967723bb	Move lowered requirement source type out of uv-pypi-types (#12356) ... ## Summary This crate is for standards-compliant types, but this is explicitly a type that's custom to uv. It's also strange because we kind of want to reference `IndexUrl` on the registry type, but that's in a crate that _depends_ on `uv-pypi-types`, which to me is a sign that this is off.	2025-03-20 21:16:12 -04:00