5622 commits

Author	SHA1	Message	Date
konsti	12764df8b2	Show a dedicated error for venvs in source trees (#15748) ... A user in the support chat had an error message for `uv build` with the `uv_build` backend they didn't understand, which was caused by them having a venv in their build directory. This PR adds a dedicated error message when adding something to a distribution that looks like a venv.	2025-09-09 12:41:58 +00:00
Zanie Blue	9d3a3843c3	Ban empty usernames and passwords in uv auth (#15743) ... Otherwise, you can get yourself in a weird state?	2025-09-09 06:23:33 -05:00
konsti	d9b63dc547	Use workspace dependencies in uv-keyring (#15738) ... It seems that this was during the vendoring of the keyring crate.	2025-09-09 09:05:43 +02:00
Yiğit Ö. Ünver	19ea0f4932	support --no-project in uv format (#15572) ... When a user passes `--no-project` argument to `uv format` command, instead of running the formatter in the context of the current project, run it in the context of the current directory. This is useful when the current directory is not a project. Closes https://github.com/astral-sh/uv/issues/15462	2025-09-08 16:16:40 -05:00
renovate[bot]	bd36952492	Update Rust crate toml to v0.9.5 (#15727) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [toml](https://redirect.github.com/toml-rs/toml) | workspace.dependencies | patch | `0.9.2` -> `0.9.5` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>toml-rs/toml (toml)</summary> ### [`v0.9.5`](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.4...toml-v0.9.5) [Compare Source](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.4...toml-v0.9.5) ### [`v0.9.4`](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.3...toml-v0.9.4) [Compare Source](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.3...toml-v0.9.4) ### [`v0.9.3`](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.2...toml-v0.9.3) [Compare Source](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.2...toml-v0.9.3) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuOTEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-09-08 15:06:38 +00:00
konsti	39fe2d9eac	Error early for parent path in build backend (#15733) ... Paths referencing above the directory of the `pyproject.toml`, such as `module-root = ".."`, are not supported by the build backend. The check that should catch was not working properly, so the source distribution built successfully and only the wheel build failed. We now error early. The same fix is applied to data includes. Fix #15702	2025-09-08 13:53:16 +00:00
Zanie Blue	5f8c7181b9	Improve the CLI help for options that accept requirements files (#15706)	2025-09-08 08:23:52 -05:00
renovate[bot]	25ca424551	Update Rust crate mimalloc to v0.1.48 (#15724) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [mimalloc](https://redirect.github.com/purpleprotocol/mimalloc_rust) | dependencies | patch | `0.1.47` -> `0.1.48` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>purpleprotocol/mimalloc_rust (mimalloc)</summary> ### [`v0.1.48`](https://redirect.github.com/purpleprotocol/mimalloc_rust/releases/tag/v0.1.48): Version 0.1.48 [Compare Source](https://redirect.github.com/purpleprotocol/mimalloc_rust/compare/v0.1.47...v0.1.48) ##### Changes - Mimalloc `v3` feature flag. (credits [@&#8203;gschulze](https://redirect.github.com/gschulze)). </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuOTEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-09-08 07:08:37 +00:00
Charlie Marsh	5012b4e831	Allow --editable to override editable = false annotations (#15712) ... ## Summary We support `--no-editable` on the CLI, but now that workspace members and path dependencies can be marked as `editable = false`, I think it makes sense for `--editable` to override that.	2025-09-07 14:37:04 -04:00
Charlie Marsh	e84c9231aa	Allow editable = false for workspace sources (#15708) ... ## Summary This ended up being a bit more complex, similar to `package = false`, because we need to understand the editable status _globally_ across the workspace based on the packages that depend on it. Closes https://github.com/astral-sh/uv/issues/15686.	2025-09-07 15:41:17 +00:00
konsti	97777cda66	Don't trace logs all architectures (#15710) ... On my machine, this statement print over 500 lines for `uv python list -vv` of evident statements.	2025-09-07 17:31:50 +02:00
Brendan	cbcf51391f	fix: refresh activation scripts from upstream virtualenv (#15272) ... ## Summary This refreshes the venv activation scripts from upstream `virtualenv` project. This was largely triggered by a problem in the activate.nu script (for nushell): - #14888 - #14914 - #14917 I was careful to respect the git history going back to astral-sh/uv#3376 (the last time this was done). Actually I looked at the complete history from back when this `uv-virtualenv` crate was named after a Pokémon (⁉️), but I found nothing (about activation scripts) from back then that hasn't been overwritten since. ### Some post-processing was involved - Retained license info at top of scripts - Retained template vars (eg `{{ BIN_PATH }}`) to assure current support toward relocatable venv - Retained deviation from upstream in astral-sh/uv#5640. This seems to be the only deviation that isn't in sync with upstream. ### Notable changes from upstream - (omitted due to undesirable complexity) pypa/virtualenv#2928 and its follow-up pypa/virtualenv#2940 - pypa/virtualenv#2910 (what prompted astral-sh/uv#14917 from astral-sh/uv#14888) ## Test Plan There was a request in #14917 to add unit tests to detect breakage or errors. I have added a CI job that runs the nushell activation script. But I think it is better to have the CI test all/most supported shells. See also #15294 I have tested this locally using - [x] nushell (v0.106.1) - [x] cmd.exe (Microsoft Windows [Version 10.0.26100.4946]) - [x] bash in WSL (GNU bash, version 5.1.16(1)-release (x86_64-pc-linux-gnu)) - [x] pwsh (PSVersion 5.1.26100.4768)	2025-09-05 16:12:37 -05:00
Jorge Hermo	c59ead398d	Allow uv format in unmanaged projects (#15553) ... Closes #15550 --------- Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-09-05 13:14:41 -05:00
Ahmed Ilyas	6eefde28e7	Support --with-requirements script.py and -r script.py to include inline dependency metadata from another script (#12763) ... ## Summary Closes #6542 ## Test Plan `cargo test`	2025-09-05 11:45:46 -05:00
Zanie Blue	e136a51f3d	Skip Python interpreters that cannot be queried with permission errors (#15685) ... Closes https://github.com/astral-sh/uv/issues/15651	2025-09-05 09:03:41 -05:00
konsti	549fb121ba	Support recursive requirements and constraints inclusion (#15657) ... uv currently panics with a stack overflow when requirements or constraints are recursively included. Instead, we ignore files we have already seen. The one complexity here is that we have to track whether we're in a requirements inclusion or in a constraints inclusion, to allow including a file separately for requirements and for constraints, and to handle `-r` inside or `-c` (which we treat as constraints too). Fixes #15650	2025-09-05 11:20:12 +02:00
konsti	4a1813f228	Extract IO errors from h2 for streaming retries of Connection Reset (#15675) ... Our streaming retries were missing connection reset errors as h2 was shadowing IO errors (https://github.com/hyperium/h2/issues/862). **Test plan** In one terminal: ``` cargo python uninstall 3.12 && cargo run python install 3.12 -vv ``` In another: ``` sudo tcpkill -i wlp2s0 port 443 ``` Output: ``` error: Failed to install cpython-3.12.11-linux-x86_64-gnu Caused by: Request failed after 3 retries Caused by: Failed to download 20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz Caused by: error sending request for url (20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz) Caused by: client error (SendRequest) Caused by: connection error Caused by: connection reset ``` I don't know how to test that from inside Rust. Fix #14171 (again, hopefully)	2025-09-04 14:45:00 +02:00
Charlie Marsh	580bc9d079	Avoid erroring when match-runtime target is optional (#15671) ... ## Summary If the package that has the `match-runtime` dependency itself isn't being installed, we should avoid erroring if the package it _depends on_ isn't in the resolution. Closes https://github.com/astral-sh/uv/issues/15661.	2025-09-04 08:34:53 -04:00
github-actions[bot]	4162005df8	Sync latest Python releases (#15670) ... Automated update for Python releases. Co-authored-by: zanieb <2586601+zanieb@users.noreply.github.com>	2025-09-03 20:04:55 -05:00
timrid	330e56e778	Support iOS platform tags (#15640) ... ## Summary This implements the iOS part of https://github.com/astral-sh/uv/issues/8029 FYI: @freakboy3742 <!-- What's the purpose of the change? What does it do, and why? --> ## Test Plan Create a venv with uv and run `cargo run pip install --python-platform arm64-apple-ios pillow`. Then the iOS binary of pillow should be installed inside the venv.	2025-09-03 18:24:48 -04:00
Zanie Blue	50bfa8a689	Add logging of incompatible tags on satisfies check (#15663) ... I was trying to understand https://github.com/astral-sh/uv/issues/9559 and think we need more logs to see what's going on.	2025-09-03 11:45:49 -05:00
timrid	d178e45368	Support Android platform tags (#15646) ... ## Summary This implements the Android part of https://github.com/astral-sh/uv/issues/8029 FYI: @freakboy3742 @mhsmith <!-- What's the purpose of the change? What does it do, and why? --> ## Test Plan Create a venv with uv and run `cargo run pip install --python-platform aarch64-linux-android pybase64`. Then the Android binary of pybase64 should be installed inside the venv.	2025-09-03 10:24:33 -04:00
konsti	a94f7d0847	Clarify that uv auth commands take a URL (#15664) ... From the previous description I tried `uv auth token pyx`, which didn't work. --------- Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-09-03 14:16:16 +00:00
Charlie Marsh	8473ecba11	Require HTTPS for CDN requests (#15660) ... ## Summary This should arguably enforce same-realm (as the API), but this is a good guardrail for now.	2025-09-03 13:32:12 +00:00
Charlie Marsh	ad35d120d6	Make uv auth dir service-aware (#15649) ... ## Summary This got lost when https://github.com/astral-sh/uv/pull/15637 was merged into not-`main`.	2025-09-02 22:58:59 -04:00
Charlie Marsh	70cb0df7c2	Bump version to v0.8.15 (#15648)	2025-09-03 02:10:58 +00:00
Charlie Marsh	4e48d759c4	Add zstandard support for wheels (#15645) ... ## Summary This PR allows pyx to send down hashes for zstandard-compressed tarballs. If the hash is present, then the file is assumed to be present at `${wheel_url}.tar.zst`, similar in design to PEP 658 `${wheel_metadata}.metadata` files. The intent here is that the index must include the wheel (to support all clients and support random-access), but can optionally include a zstandard-compressed version alongside it.	2025-09-03 01:38:31 +00:00
Charlie Marsh	7606f1ad3c	Add uv publish --dry-run (#15638) ... ## Summary `uv publish --dry-run` will perform the `--check-url` validation, and hit the `/validate` endpoint if the registry is known to support fast-path validation (like pyx). The `/validate` endpoint lets us validate an upload without uploading the file _contents_, which lets you skip the expensive step for common mistakes. In the future, my hope is that the `/validate` step will deprecated in favor of Upload API 2.0.	2025-09-02 21:24:31 -04:00
Charlie Marsh	b57ad179b6	Allow registries to pre-provide core metadata (#15644) ... ## Summary This PR adds support for the `application/vnd.pyx.simple.v1` content type, similar to `application/vnd.pypi.simple.v1` with the exception that it can also include core metadata for package-versions directly.	2025-09-03 00:56:29 +00:00
Charlie Marsh	f88aaa8740	Add pyx support to uv auth commands (#15636) ... ## Summary This PR adds support for pyx to `uv auth login`, `uv auth logout`, and `uv auth token`. These are generic uv commands that can be used to store credentials for arbitrary indexes and other URLs, but we include a fast-path for pyx that initiates the appropriate login or logout flow.	2025-09-02 18:18:09 -04:00
Zanie Blue	f9e98d1fb6	Allow providing the uv auth login password or token via stdin (#15642)	2025-09-02 16:59:58 -05:00
Zanie Blue	63b93a1db0	Add test cases for URL matching with the native keyring (#15641)	2025-09-02 16:56:40 -05:00
github-actions[bot]	8fcd88d2d4	Sync latest Python releases (#15631) ... Update to python-build-standalone 20250902 mostly for SQLite 3.50.4/CVE-2025-6965.	2025-09-02 18:43:17 +00:00
Zanie Blue	45946b80b0	Allow storage of multiple usernames per service in the plaintext store (#15628) ... We weren't keying our hash map with the username, which meant that only one user could be used per service.	2025-09-02 13:16:52 -05:00
Zanie Blue	709e0ba238	Remove the native system store from the keyring providers (#15612) ... We're not sure what the best way to expose the native store to users is yet and it's a bit weird that you can use this in the `uv auth` commands but can't use any of the other keyring provider options. The simplest path forward is to just not expose it to users as a keyring provider, and instead frame it as a preview alternative to the plaintext uv credentials store. We can revisit the best way to expose configuration before stabilization. Note this pull request retains the _internal_ keyring provider implementation — we can refactor it out later but I wanted to avoid a bunch of churn here.	2025-09-02 13:16:52 -05:00
Zanie Blue	bc1bbfb066	Respect usernames when finding matching credentials in the plaintext store (#15620) ... We're not respecting the username when searching for a match, which is no good!	2025-09-02 13:16:52 -05:00
Zanie Blue	7ac957af8f	Lock the credentials store when reading or writing (#15610) ... Adds locking of the credentials store for concurrency safety. It's important to hold the lock from read -> write so credentials are not dropped during concurrent writes. I opted not to attach the lock to the store itself. Instead, I return the lock on read and require it on write to encourage safe use. Maybe attaching the source path to the store struct and adding a `lock(&self)` method would make sense? but then you can forget to take the lock at the right time. The main problem with the interface here is to write a _new_ store you have to take the lock yourself, and you could make a mistake by taking a lock for the wrong path or something. The fix for that would be to introduce a new `CredentialStoreHandle` type or something, but that seems overzealous rn. We also don't eagerly drop the lock on token read, although we could.	2025-09-02 13:16:52 -05:00
Zanie Blue	7d627b50ef	Add uv auth dir (#15600)	2025-09-02 13:16:52 -05:00
Charlie Marsh	e3cb13868d	Use a dedicated wire type for credentials serialization (#15599) ... This is a little closer to what we do elsewhere when we want to encapsulate differences in the serialization format.	2025-09-02 13:16:52 -05:00
Charlie Marsh	7d9446450b	Misc. tweaks	2025-09-02 13:16:52 -05:00
Zanie Blue	a13fb3ec64	Respect UV_CREDENTIALS_DIR (#15598)	2025-09-02 13:16:52 -05:00
Zanie Blue	0b5180cb37	Strip the trailing /simple from index URLs provided to uv auth login (#15591) ... I'm pretty sure we need to do this for robust lookups of URLs served by indexes.	2025-09-02 13:16:52 -05:00
Zanie Blue	ac5dc9be1f	Add a plain text backend for credential storage (#15588) ... Adds a default plain text storage mechanism to `uv auth`. While we'd prefer to use the system store, the "native" keyring support is experimental still and I don't want to ship an unusable interface. @geofft also suggested that the story for secure credential storage is much weaker on Linux than macOS and Windows and felt this approach would be needed regardless. We'll switch over to using the native keyring by default in the future. On Linux, we can now fallback to a plaintext store the secret store is not configured, which is a nice property. Right now, we store credentials in a TOML file in the uv state directory. I expect to also read from the uv config directory in the future, but we don't need it immediately.	2025-09-02 13:16:52 -05:00
Zanie Blue	ddf2f5ed8c	Remove unused dependencies from uv auth preview refactor (#15589)	2025-09-02 13:16:52 -05:00
Zanie Blue	7162085846	Update messaging for uv auth (#15573) ... To clarify that we are not validating the credentials	2025-09-02 13:16:52 -05:00
Zanie Blue	a68007aa61	Update uv auth snapshots	2025-09-02 13:16:52 -05:00
Zanie Blue	f9e974c1f9	Only allow HTTPS services in login for now (#15559)	2025-09-02 13:16:52 -05:00
Zanie Blue	a1cc12af2b	Add support for credentials in URLs to uv auth (#15554) ... Allows cases like `uv auth login https://username:password@example.com` for coherence with the rest of our interfaces.	2025-09-02 13:16:52 -05:00
Zanie Blue	4ad5ae5e6f	Add preview warnings to native-keyring usage (#15555) ... The refactor here was all done by Claude Code.	2025-09-02 13:16:52 -05:00
Zanie Blue	460ea6e9eb	Add uv auth commands (login, logout, and token) (#15539) ... Picks up the work from - #14559 - https://github.com/astral-sh/uv/pull/14896 There are some high-level changes from those pull requests 1. We do not stash seen credentials in the keyring automatically 2. We use `auth login` and `auth logout` (for future consistency) 3. We add a `token` command for showing the credential that will be used As well as many smaller changes to API, messaging, testing, etc. --------- Co-authored-by: John Mumm <jtfmumm@gmail.com>	2025-09-02 13:16:52 -05:00