7701 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Zanie Blue	561d41dadd	Use non-editable installs for workspace member dependencies of tools	2025-10-23 16:01:16 -05:00
Zanie Blue	0959763a82	Improve hint on pip install --system when externally managed (#16392) ... I had some qualms with https://github.com/astral-sh/uv/pull/16318 1. The snapshot was specific to uv's managed interpreter due to inclusion of the externally-managed output. This will break downstream distros. We either need to filter the message, or, as done here, install a managed interpreter. 2. It had a custom filter for the interpreter path, which we shouldn't need. If needed, we should fix that in the test context. 3. We already had an implicit hint to create a virtual environment. The change in styling of the new hint hint following it is confusing. It's also confusing to hint creating a virtual environment when `--system` was used. 4. There were unresolved requested changes to the language for the message / it didn't fit stylistic with our existing ones. 5. The message was also very confusing for a uv-managed interpreter, which is both a "system" Python interpreter (in that it's global) and the opposite of a "system" interpreter per UV_PYTHON_PREFERENCE. Also problematic, but not addressed here, is that there are other commands that display an externally-managed message, e.g., `uv pip sync`, but #16318 was just limited to `pip install`. We should not just implement this in one place — I'll open a tracking issue to consolidate and reuse the logic.	2025-10-21 17:59:01 +00:00
Charles-Meldhine Madi Mnemoi	225bffbb6c	Running uv lock --check with outdated lockfile will print that --check was passed, instead of --locked (#16322) ... Hello, # Summary This PR fixes the confusing error message when running `uv lock --check` with an outdated lockfile. Previously, the error message incorrectly stated that `--locked` was provided, even when the user used `--check`. Now, the error message correctly indicates which flag was used: either `--check` or `--locked`. This closes #14105. # Test plan - I updated the existing integration test (`check_outdated_lock` in `lock.rs`) to verify the new error message includes the correct flag. - I ran existing tests to ensure I have no introduced regressions for other commands.	2025-10-21 12:46:10 -05:00
William Woodruff	509a1e8ff6	CHANGELOG: include security note + entry for 0.9.5 (#16393)	2025-10-21 13:33:28 -04:00
William Woodruff	d5f39331a7	Bump version to 0.9.5 (#16389)	2025-10-21 12:14:22 -04:00
konsti	1a53701d1d	Deactivate zizmor due to GitHub ratelimiting (#16390)	2025-10-21 15:36:20 +00:00
William Woodruff	ae450662d1	deps: bump astral-tokio-tar to 0.5.6 (#16387)	2025-10-21 10:55:58 -04:00
konsti	38412a675e	Remove outdated aarch64 musl note (#16385) ... We now build aarch64 musl Python distributions. I've also removed the rye mention since it's now officially deprecated.	2025-10-21 16:08:37 +02:00
Samuel Rigaud	2fc5fe2ac0	fix small typos (#16357) ... ## Summary I tried to fix minor typos in the project --------- Co-authored-by: Samuel Rigaud <rigaud@gmail.com> Co-authored-by: konstin <konstin@mailbox.org>	2025-10-21 12:11:59 +00:00
Jordan Borean	17155c4cca	Fix backtick escaping for PowerShell (#16307) ... ## Summary Fixes the logic for escaping a double quoted string in PowerShell by not escaping a backslash but escaping the Unicode double quote variants that PowerShell treats the same as the ASCII double quotes. <img width="685" height="99" alt="image" src="https://github.com/user-attachments/assets/ac1368c2-d915-4e49-b67f-ac71ee0f7d46" /> ## Test Plan There does not seem to be any tests for this. I'm fairly new to rust but happy to add some if someone can point me in the right direction. --------- Co-authored-by: Aria Desires <aria.desires@gmail.com>	2025-10-21 10:16:21 +00:00
Andrei Berenda	51e8da2d1c	Move parsing http retries to EnvironmentOptions (#16284) ... ## Summary - Move parsing `UV_HTTP_RETRIES` to `EnvironmentOptions` Relates https://github.com/astral-sh/uv/issues/14720 ## Test Plan - Tests with existing tests	2025-10-21 11:14:37 +02:00
Charles-Meldhine Madi Mnemoi	29cec24d5c	fix: Add a hint on uv pip install failure if the --system flag is used to select an externally managed interpreter (#16318) ... Hello, # Summary This PR makes the error message clearer when you try to install packages into an externally managed Python environment with the `--system` flag. Now, instead of just failing, the error explains that you're hitting this because you explicitly used `--system`. This closes #15639. # Test plan - I added a new integration test (`install_with_system_interpreter` in `pip_install.rs`) that checks the error message includes the hint. - I tried to run `uv pip install --system -r requirements.txt` to see the actual error message in action, but had permission issues.	2025-10-21 07:46:39 +00:00
github-actions[bot]	ed65c2482c	Sync latest Python releases (#16246) ... Automated update for Python releases. Co-authored-by: zanieb <2586601+zanieb@users.noreply.github.com>	2025-10-21 00:41:53 +00:00
eun2ce	e0fe38eabb	Improve 403 Forbidden error message to indicate package may not exist (#16353) ... Fixes #16340 ## Summary Some package registries (PyTorch, corporate PyPI mirrors) return `403 Forbidden` when a package is not found, instead of `404 Not Found`. The previous error message incorrectly suggested this was always an authentication issue, causing confusion for users. This PR updates the error hint to clarify that a 403 error could indicate either missing authentication credentials OR that the package doesn't exist on the index. ## Test Plan - Updated existing snapshot test in `crates/uv/tests/it/edit.rs` to reflect the new error message - The change is purely a message improvement with no behavioral changes ## Changes ### Before hint: An index URL (https://example.com/simple) could not be queried due to a lack of valid authentication credentials (403 Forbidden). ### After hint: An index URL (https://example.com/simple) returned a 403 Forbidden error. This could indicate missing authentication credentials, or the package may not exist on this index. ## Files Changed - `crates/uv-resolver/src/pubgrub/report.rs` - Updated error message - `crates/uv/tests/it/edit.rs` - Updated snapshot test expectation --------- Co-authored-by: eun2ce <eun2ce@eun2ceui-MacBookPro.local> Co-authored-by: konstin <konstin@mailbox.org>	2025-10-20 11:43:18 +00:00
Parham MohammadAlizadeh	ed3f99a119	Add required environment marker example to hint (#16244) ... ## Summary fixes issue #15938 - show platform wheel hint with a concrete `tool.uv.required-environments` example so users know how to configure compatibility - add `WheelTagHint::suggest_environment_marker` to pick a sensible environment marker based on the available wheel tags - update the `sync_required_environment_hint` integration snapshot to expect the new multi-line hint ## Test Plan cargo test --package uv --test it -- sync::sync_required_environment_hint	2025-10-20 13:08:10 +02:00
renovate[bot]	2b0407e277	Update dependency astral-sh/uv to v0.9.4 (#16363) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/uv](https://redirect.github.com/astral-sh/uv) | uses-with | patch | `0.9.2` -> `0.9.4` | --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.9.4`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#094) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.9.3...0.9.4) Released on 2025-10-17. ##### Enhancements - Add CUDA 13.0 support ([#&#8203;16321](https://redirect.github.com/astral-sh/uv/pull/16321)) - Add auto-detection for Intel GPU on Windows ([#&#8203;16280](https://redirect.github.com/astral-sh/uv/pull/16280)) - Implement display of RFC 9457 HTTP error contexts ([#&#8203;16199](https://redirect.github.com/astral-sh/uv/pull/16199)) ##### Bug fixes - Avoid obfuscating pyx tokens in `uv auth token` output ([#&#8203;16345](https://redirect.github.com/astral-sh/uv/pull/16345)) ### [`v0.9.3`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#093) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.9.2...0.9.3) Released on 2025-10-14. ##### Python - Add CPython 3.15.0a1 - Add CPython 3.13.9 ##### Enhancements - Obfuscate secret token values in logs ([#&#8203;16164](https://redirect.github.com/astral-sh/uv/pull/16164)) ##### Bug fixes - Fix workspace with relative pathing ([#&#8203;16296](https://redirect.github.com/astral-sh/uv/pull/16296)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNDMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE0My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-10-20 10:33:57 +02:00
renovate[bot]	1bdd85b4e8	Update Rust crate globset to v0.4.17 (#16365) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [globset](https://redirect.github.com/BurntSushi/ripgrep/tree/master/crates/globset) ([source](https://redirect.github.com/BurntSushi/ripgrep/tree/HEAD/crates/globset)) | workspace.dependencies | patch | `0.4.16` -> `0.4.17` | --- ### Release Notes <details> <summary>BurntSushi/ripgrep (globset)</summary> ### [`v0.4.17`](https://redirect.github.com/BurntSushi/ripgrep/compare/globset-0.4.16...globset-0.4.17) [Compare Source](https://redirect.github.com/BurntSushi/ripgrep/compare/globset-0.4.16...globset-0.4.17) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNDMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE0My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-10-20 10:32:48 +02:00
renovate[bot]	152461bc43	Update Rust crate ignore to v0.4.24 (#16367) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ignore](https://redirect.github.com/BurntSushi/ripgrep/tree/master/crates/ignore) ([source](https://redirect.github.com/BurntSushi/ripgrep/tree/HEAD/crates/ignore)) | workspace.dependencies | patch | `0.4.23` -> `0.4.24` | --- ### Release Notes <details> <summary>BurntSushi/ripgrep (ignore)</summary> ### [`v0.4.24`](https://redirect.github.com/BurntSushi/ripgrep/compare/ignore-0.4.23...ignore-0.4.24) [Compare Source](https://redirect.github.com/BurntSushi/ripgrep/compare/ignore-0.4.23...ignore-0.4.24) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNDMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE0My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-10-20 10:32:02 +02:00
renovate[bot]	c494c2c0b0	Update Rust crate goblin to v0.10.3 (#16366)	2025-10-20 01:32:05 +00:00
konsti	2428a1664e	Document metadata consistency expectation (#15683) ... An opinionated write-up on why Python packaging needs metadata consistency, and that we need to extend metadata to accommodate ML and scientific users. I didn't add a paragraph related to CUDA or accelerators in general and wheel variants, as this is currently support neither by wheel tags nor by PEP 508 markers, so it's not a strict metadata consistency concern, plus this would get outdated quickly as wheel variants progress.	2025-10-19 14:29:47 +02:00
Björn Dahlgren	57f56467d9	Fix typo in MissingTopLevel warning (#16351) ... <!-- Thank you for contributing to uv! To help us out with reviewing, please consider the following: - Does this pull request include a summary of the change? (See below.) - Does this pull request include a descriptive title? - Does this pull request include references to any relevant issues? --> ## Summary <!-- What's the purpose of the change? What does it do, and why? --> The warning shown when `egg-info` lacks `top_level.txt` incorrectly warns about missing `top-level.txt` ee2649feaa/crates/uv-install-wheel/src/uninstall.rs (L179-L188) ee2649feaa/crates/uv/src/commands/pip/operations.rs (L687-L693) The non fatal warning with incorrect filename was introduced in https://github.com/astral-sh/uv/pull/6881 which changed previous fatal error https://github.com/astral-sh/uv/issues/6872 with correct `top_level.txt` output. ## Test Plan <!-- How was it tested? --> Updated unit test to reflect change in warning	2025-10-19 11:32:50 +02:00
Zanie Blue	88f519a3bf	Drop annotations from DockerHub uv images (#16356)	2025-10-18 14:58:06 -05:00
Zanie Blue	70cfc4020a	Drop publish of extended images to DockerHub temporarily (#16355) ... To workaround https://github.com/astral-sh/uv/issues/16350	2025-10-18 14:47:48 -05:00
Zanie Blue	ee2649feaa	Bump version to 0.9.4 (#16347)	2025-10-17 16:02:02 -05:00
David Peter	b50c1be100	Only add actual schema in schemastore PRs (#16346) ... ## Summary Last time I ran the `update_schemastore.py` script in ty, due to what I assume was a `npm` version mismatch, the `package-lock.json` file was updated while running `npm install` in the `schemastore`. Due to the use of `git commit -a`, it was accidentally included in the commit for the semi-automated schemastore PR. The solution here is to only add the actual file that we want to commit. Same as https://github.com/astral-sh/ty/pull/1391 ## Test Plan I did a dry-run of this script (by commenting out the final `push`) and verified that the commit did include the schema, but not the updated `package-lock.json` file.	2025-10-17 19:35:53 +00:00
Zanie Blue	7b3a9c2859	Avoid obfuscating pyx tokens in uv auth token output (#16345)	2025-10-17 19:19:05 +00:00
Yu, Guangye	de9f299b80	Add auto-detection for Intel GPU on Windows (#16280) ... This PR enables `--torch-backend=auto` to automatically detect Intel GPUs. It follows up on [#14386](https://github.com/astral-sh/uv/pull/14386). On Windows, detection is implemented by querying the `Win32_VideoController` class via the [WMI crate](https://github.com/ohadravid/wmi-rs/tree/v0.16.0). Currently, Intel GPUs (XPU) do not depend on specific driver or toolkit versions to determine which PyTorch wheel to use.	2025-10-16 16:56:07 -04:00
Mark Dodgson	c12e8bb343	Implement RFC9457 compliant messaging (#16199) ... <!-- Thank you for contributing to uv! To help us out with reviewing, please consider the following: - Does this pull request include a summary of the change? (See below.) - Does this pull request include a descriptive title? - Does this pull request include references to any relevant issues? --> ## Summary HTTP1.1 [RFC 9112 - HTTP/1.1](https://www.rfc-editor.org/rfc/rfc9112.html#name-status-line) section 4 defines the response status code to optionally include a text description (human readable) of the reason for the status code. [RFC9113 - HTTP/2](https://www.rfc-editor.org/rfc/rfc9113) is the HTTP2 protocol standard and the response status only considers the [status code](https://www.rfc-editor.org/rfc/rfc9113#name-response-pseudo-header-fiel) and not the reason phrase, and as such important information can be lost in helping the client determine a route cause of a failure. As per discussion on this [PR](https://github.com/astral-sh/uv/pull/15979) the current feeling is that implementing the RFC9457 standard might be the preferred route. This PR makes those changes to aid the discussion which has also been moved to the [PEP board](https://discuss.python.org/t/block-download-of-components-when-violating-policy/104021/1) ## Test Plan Pulling components that violate our policy over HTTP2 and without any RFC9457 implementation the following message is presented to the user: <img width="1482" height="104" alt="image" src="https://github.com/user-attachments/assets/0afcd0d8-ca67-4f94-a6c2-131e3b6d8dcc" /> With the RFC9457 standard implemented, below you can see the advantage in the extra context as to why the component has been blocked: <img width="2171" height="127" alt="image" src="https://github.com/user-attachments/assets/25bb5465-955d-4a76-9f30-5477fc2c866f" /> --------- Co-authored-by: konstin <konstin@mailbox.org>	2025-10-16 19:53:49 +00:00
Zanie Blue	0a2b160400	Migrate from deprecated macos-13 runner to macos-15-intel (#16316)	2025-10-16 09:07:18 -05:00
Charlie Marsh	bf81a5bf0c	Add CUDA 13.0 support (#16321) ... ## Summary Closes https://github.com/astral-sh/uv/issues/16319.	2025-10-15 15:10:08 -04:00
konsti	766bd951cb	Use uv_build in make_project tests (#16298) ... Skip downloading and running setuptools.	2025-10-15 20:45:32 +02:00
konsti	52cc3c8b94	Add missing UV_TEST_NO_HTTP_RETRY_DELAY check and better logging (#16313) ... The `install_http_retries` test goes from 15s to 0.3s. Additionally, we log the retry delay.	2025-10-15 20:45:21 +02:00
Zanie Blue	83635a6c45	Update changelog to escape GitHub bad behavior (#16315)	2025-10-15 08:45:05 -05:00
Zanie Blue	9db7d38cf7	Bump version to 0.9.3 (#16305)	2025-10-14 18:19:49 -05:00
Zanie Blue	d1413a60d8	Add CPython 3.15.0a1 and 3.13.9 (#16304)	2025-10-14 18:05:44 -05:00
Mark Dodgson	b151e0ea3d	Fix workspace with relative pathing (#16296) ... <!-- Thank you for contributing to uv! To help us out with reviewing, please consider the following: - Does this pull request include a summary of the change? (See below.) - Does this pull request include a descriptive title? - Does this pull request include references to any relevant issues? --> ## Summary Fixes #16285 ## Test Plan <!-- How was it tested? -->	2025-10-14 19:15:19 +02:00
Geoffrey Thomas	8eada1685c	Fix comments on python_no_transparent_upgrade_with_venv_patch_specification (#16294) ... I think this was originally intended to behave as the comments specified, but the behavior changed in discussions in #13312 somewhere.	2025-10-14 07:32:47 -05:00
renovate[bot]	f9fbf41f69	Update Rust crate ref-cast to v1.0.25 (#16272)	2025-10-13 10:59:44 -04:00
renovate[bot]	45e8b38bb6	Update Rust crate thiserror to v2.0.17 (#16276)	2025-10-13 10:59:09 -04:00
renovate[bot]	ae273f35d3	Update Rust crate serde to v1.0.228 (#16275)	2025-10-13 10:59:01 -04:00
Zanie Blue	15829bb30a	Obfuscate Bearer Token values in logs (#16164) ... Sometimes a credential's `Debug` formatted value appears in tracing logs - make sure the credential doesn't appear there. ## Test plan Added a test case + ran ``` uv pip install --default-index $PYX_API_URL/$SOME_INDEX $SOME_PACKAGE -vv ``` With an authenticated uv client and confirmed the tokens are obfuscated. --------- Co-authored-by: Zsolt Dollenstein <zsol.zsol@gmail.com>	2025-10-13 08:28:20 -05:00
renovate[bot]	01d43382be	Update Rust crate rkyv to v0.8.12 (#16274)	2025-10-13 02:57:25 +00:00
renovate[bot]	e3690e702f	Update Rust crate regex-automata to v0.4.12 (#16273)	2025-10-13 02:55:24 +00:00
renovate[bot]	15f1dc6269	Update Rust crate petgraph to v0.8.3 (#16270)	2025-10-13 02:42:49 +00:00
renovate[bot]	3837b92cc1	Update Rust crate owo-colors to v4.2.3 (#16269)	2025-10-13 02:40:07 +00:00
renovate[bot]	dd89bdaab0	Update Rust crate quote to v1.0.41 (#16271)	2025-10-13 02:36:45 +00:00
renovate[bot]	cd859ccd17	Update Rust crate memchr to v2.7.6 (#16268)	2025-10-12 22:21:43 -04:00
renovate[bot]	c741e4bfb5	Update Rust crate fs-err to v3.1.3 (#16265)	2025-10-12 22:21:23 -04:00
renovate[bot]	7d5795e2a5	Update Rust crate flate2 to v1.1.4 (#16264)	2025-10-12 22:21:17 -04:00
renovate[bot]	1b91b31763	Update Rust crate goblin to v0.10.2 (#16266)	2025-10-13 02:00:35 +00:00