5741 commits

Author	SHA1	Message	Date
Zanie Blue	8f3583a6e6	Allow selection of debug build interpreters (#11520) ... Extends the `PythonVariant` logic to support interpreters with the debug flag enabled.	2025-09-12 13:32:22 +00:00
rimathia	3081557159	Better defaults for native build backend cache keys (#15705) ... <!-- Thank you for contributing to uv! To help us out with reviewing, please consider the following: - Does this pull request include a summary of the change? (See below.) - Does this pull request include a descriptive title? - Does this pull request include references to any relevant issues? --> ## Summary This change extends the default initialized projects with scikit and maturin build backends to ensure that the rust or C++ build gets invoked when a source file changes. ## Test Plan `cargo run init cppextension-test --build-backend=scikit` followed by manual testing of the behaviour of the resulting project under `uv run --with jupyter jupyter lab` and changes to the source file of the extension. Analogous for `cargo run init maturin-test --build-backend=maturin `. ## Relevant Issues The question of why the python extension is not rebuilt on source changes has been discussed in https://github.com/astral-sh/uv/issues/15701#issuecomment-3258714942.	2025-09-12 11:14:59 +02:00
William Woodruff	21a92c1632	feat(publish): include blake2b hash in upload form (#15794)	2025-09-11 16:17:07 -04:00
Harshith VH	a0f8359012	Add conflict detection between --only-group and --extra flags (#15788) ... <!-- Thank you for contributing to uv! To help us out with reviewing, please consider the following: - Does this pull request include a summary of the change? (See below.) - Does this pull request include a descriptive title? - Does this pull request include references to any relevant issues? --> ## Summary - Added `conflicts_with = "only_group"` to `--extra` arguments in `SyncArgs`, `RunArgs`, and `ExportArgs` - Added tests to verify proper conflict detection and error messages **Before:** The `--extra` flag was silently ignored when used with `--only-group` **After:** Clear error message: `error: the argument '--only-group <ONLY_GROUP>' cannot be used with '--extra <EXTRA>'` fixes: #15676 ## Test Plan - Tests confirm proper error message format when `--only-group` and `--extra` are used together - Verified existing functionality remains unchanged when flags are used independently	2025-09-11 10:34:49 -05:00
Harsh Pratap Singh	5f2871e695	Support Gitlab CI/CD as a trusted publisher (#15583) ... Co-authored-by: William Woodruff <william@astral.sh>	2025-09-11 10:35:04 -04:00
Zanie Blue	cbb713f705	Review for #15769 (#15775) ... Addresses my review comments from https://github.com/astral-sh/uv/pull/15769	2025-09-11 13:20:13 +00:00
konsti	2ec71bd608	Update packse to 0.3.52: Fix requires python 3.12 (#15786) ... Pull in the latest packse changes to make all test work with the new default Python requirement, 3.12.	2025-09-11 13:19:34 +00:00
Zanie Blue	7789f5b217	Bump version to 0.8.17 (#15776)	2025-09-10 14:59:48 -05:00
Charlie Marsh	b195d523d5	Add pyx as a supported PyTorch index URL (#15769) ... ## Summary If the user explicitly authenticated to pyx, then we attempt to use the pyx PyTorch URLs; otherwise, we stick to `download.pytorch.org` as the default.	2025-09-10 14:38:00 -05:00
David Peter	0d174b79e2	Ignore pre-release versions in uv init --script (#15747) ... ## Summary Ignore managed pre-release versions of Python for purposes of creating a `requires-python` constraint when running `uv init --script`. This makes the behavior consistent with `uv init` for normal projects. ## Test Plan Added a regression test that makes sure that the constraint is `requires-python = ">=3.13"`, even though a pre-release version of 3.14 is installed.	2025-09-10 14:35:29 -05:00
Zanie Blue	27d205b0c3	Respect PYX_API_URL when suggesting uv auth login on 401 (#15774)	2025-09-10 19:24:46 +00:00
Charlie Marsh	ccf01fff66	Avoid initiating login flow for invalid API keys (#15773) ... ## Summary If the login flow fails, and the user provided an API key, it's unintuitive to initiate the login flow.	2025-09-10 19:07:29 +00:00
Zanie Blue	b2c59a8ace	Do not search for a password for requests with a token attached already (#15772)	2025-09-10 13:52:09 -05:00
Zanie Blue	7c716d5227	Improve error message for HTTP validation in auth services (#15768) ... Follows https://github.com/astral-sh/uv/pull/15755	2025-09-10 13:15:19 -05:00
Charlie Marsh	2de677b0d3	Bump version to v0.8.16 (#15761) ... Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-09-09 21:41:56 -04:00
konsti	e691ac7c9a	Build backend error message style consistency (#15735) ... Consistently omit backticks after a colon in build backend messages, following https://github.com/astral-sh/uv/pull/15733#discussion_r2330156783. There's still 74 matches for `: {}"` and 183 matches for `: {[^{]*}"`, but this PR clears all matches in the build backend.	2025-09-09 17:34:56 +00:00
Zsolt Dollenstein	ae2dce6d25	auth: allow insecure http only on localhost (#15755) ... ## Summary This is useful for testing purposes. ## Test Plan I tested using testing purposes.	2025-09-09 17:21:14 +01:00
Charlie Marsh	5494645fba	Use token store credentials for uv publish (#15759) ... ## Summary Running `uv publish` to pyx should re-use the already-stored token rather than prompting for credentials. Closes https://github.com/astral-sh/uv/issues/15758.	2025-09-09 16:13:31 +00:00
konsti	cd49e1d11f	Use the windows crate facade consistently (#15737) ... The initial motivation for this change was that we were using both the `windows`, the `window_sys` and the `windows_core` crate in various places. These crates have slightly unconventional versioning scheme where there is a large workspace with the same version in general, but only some crates get breaking releases when a new breaking release happens, the others stay on the previous breaking version. The `windows` crate is a shim for all three of them, with a single version. This simplifies handling the versions. Using `windows` over `windows_sys` has the advantage of a higher level error interface, we now get a `Result` for all windows API calls instead of C-style int-returns and get-last-error calls. This makes the uv-keyring crate more resilient. We keep using the `windows_registry` crate, which provides a higher level interface to windows registry access.	2025-09-09 15:07:14 +00:00
konsti	12764df8b2	Show a dedicated error for venvs in source trees (#15748) ... A user in the support chat had an error message for `uv build` with the `uv_build` backend they didn't understand, which was caused by them having a venv in their build directory. This PR adds a dedicated error message when adding something to a distribution that looks like a venv.	2025-09-09 12:41:58 +00:00
Zanie Blue	9d3a3843c3	Ban empty usernames and passwords in uv auth (#15743) ... Otherwise, you can get yourself in a weird state?	2025-09-09 06:23:33 -05:00
konsti	d9b63dc547	Use workspace dependencies in uv-keyring (#15738) ... It seems that this was during the vendoring of the keyring crate.	2025-09-09 09:05:43 +02:00
Yiğit Ö. Ünver	19ea0f4932	support --no-project in uv format (#15572) ... When a user passes `--no-project` argument to `uv format` command, instead of running the formatter in the context of the current project, run it in the context of the current directory. This is useful when the current directory is not a project. Closes https://github.com/astral-sh/uv/issues/15462	2025-09-08 16:16:40 -05:00
renovate[bot]	bd36952492	Update Rust crate toml to v0.9.5 (#15727) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [toml](https://redirect.github.com/toml-rs/toml) | workspace.dependencies | patch | `0.9.2` -> `0.9.5` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>toml-rs/toml (toml)</summary> ### [`v0.9.5`](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.4...toml-v0.9.5) [Compare Source](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.4...toml-v0.9.5) ### [`v0.9.4`](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.3...toml-v0.9.4) [Compare Source](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.3...toml-v0.9.4) ### [`v0.9.3`](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.2...toml-v0.9.3) [Compare Source](https://redirect.github.com/toml-rs/toml/compare/toml-v0.9.2...toml-v0.9.3) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuOTEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-09-08 15:06:38 +00:00
konsti	39fe2d9eac	Error early for parent path in build backend (#15733) ... Paths referencing above the directory of the `pyproject.toml`, such as `module-root = ".."`, are not supported by the build backend. The check that should catch was not working properly, so the source distribution built successfully and only the wheel build failed. We now error early. The same fix is applied to data includes. Fix #15702	2025-09-08 13:53:16 +00:00
Zanie Blue	5f8c7181b9	Improve the CLI help for options that accept requirements files (#15706)	2025-09-08 08:23:52 -05:00
renovate[bot]	25ca424551	Update Rust crate mimalloc to v0.1.48 (#15724) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [mimalloc](https://redirect.github.com/purpleprotocol/mimalloc_rust) | dependencies | patch | `0.1.47` -> `0.1.48` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>purpleprotocol/mimalloc_rust (mimalloc)</summary> ### [`v0.1.48`](https://redirect.github.com/purpleprotocol/mimalloc_rust/releases/tag/v0.1.48): Version 0.1.48 [Compare Source](https://redirect.github.com/purpleprotocol/mimalloc_rust/compare/v0.1.47...v0.1.48) ##### Changes - Mimalloc `v3` feature flag. (credits [@&#8203;gschulze](https://redirect.github.com/gschulze)). </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuOTEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-09-08 07:08:37 +00:00
Charlie Marsh	5012b4e831	Allow --editable to override editable = false annotations (#15712) ... ## Summary We support `--no-editable` on the CLI, but now that workspace members and path dependencies can be marked as `editable = false`, I think it makes sense for `--editable` to override that.	2025-09-07 14:37:04 -04:00
Charlie Marsh	e84c9231aa	Allow editable = false for workspace sources (#15708) ... ## Summary This ended up being a bit more complex, similar to `package = false`, because we need to understand the editable status _globally_ across the workspace based on the packages that depend on it. Closes https://github.com/astral-sh/uv/issues/15686.	2025-09-07 15:41:17 +00:00
konsti	97777cda66	Don't trace logs all architectures (#15710) ... On my machine, this statement print over 500 lines for `uv python list -vv` of evident statements.	2025-09-07 17:31:50 +02:00
Brendan	cbcf51391f	fix: refresh activation scripts from upstream virtualenv (#15272) ... ## Summary This refreshes the venv activation scripts from upstream `virtualenv` project. This was largely triggered by a problem in the activate.nu script (for nushell): - #14888 - #14914 - #14917 I was careful to respect the git history going back to astral-sh/uv#3376 (the last time this was done). Actually I looked at the complete history from back when this `uv-virtualenv` crate was named after a Pokémon (⁉️), but I found nothing (about activation scripts) from back then that hasn't been overwritten since. ### Some post-processing was involved - Retained license info at top of scripts - Retained template vars (eg `{{ BIN_PATH }}`) to assure current support toward relocatable venv - Retained deviation from upstream in astral-sh/uv#5640. This seems to be the only deviation that isn't in sync with upstream. ### Notable changes from upstream - (omitted due to undesirable complexity) pypa/virtualenv#2928 and its follow-up pypa/virtualenv#2940 - pypa/virtualenv#2910 (what prompted astral-sh/uv#14917 from astral-sh/uv#14888) ## Test Plan There was a request in #14917 to add unit tests to detect breakage or errors. I have added a CI job that runs the nushell activation script. But I think it is better to have the CI test all/most supported shells. See also #15294 I have tested this locally using - [x] nushell (v0.106.1) - [x] cmd.exe (Microsoft Windows [Version 10.0.26100.4946]) - [x] bash in WSL (GNU bash, version 5.1.16(1)-release (x86_64-pc-linux-gnu)) - [x] pwsh (PSVersion 5.1.26100.4768)	2025-09-05 16:12:37 -05:00
Jorge Hermo	c59ead398d	Allow uv format in unmanaged projects (#15553) ... Closes #15550 --------- Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-09-05 13:14:41 -05:00
Ahmed Ilyas	6eefde28e7	Support --with-requirements script.py and -r script.py to include inline dependency metadata from another script (#12763) ... ## Summary Closes #6542 ## Test Plan `cargo test`	2025-09-05 11:45:46 -05:00
Zanie Blue	e136a51f3d	Skip Python interpreters that cannot be queried with permission errors (#15685) ... Closes https://github.com/astral-sh/uv/issues/15651	2025-09-05 09:03:41 -05:00
konsti	549fb121ba	Support recursive requirements and constraints inclusion (#15657) ... uv currently panics with a stack overflow when requirements or constraints are recursively included. Instead, we ignore files we have already seen. The one complexity here is that we have to track whether we're in a requirements inclusion or in a constraints inclusion, to allow including a file separately for requirements and for constraints, and to handle `-r` inside or `-c` (which we treat as constraints too). Fixes #15650	2025-09-05 11:20:12 +02:00
konsti	4a1813f228	Extract IO errors from h2 for streaming retries of Connection Reset (#15675) ... Our streaming retries were missing connection reset errors as h2 was shadowing IO errors (https://github.com/hyperium/h2/issues/862). **Test plan** In one terminal: ``` cargo python uninstall 3.12 && cargo run python install 3.12 -vv ``` In another: ``` sudo tcpkill -i wlp2s0 port 443 ``` Output: ``` error: Failed to install cpython-3.12.11-linux-x86_64-gnu Caused by: Request failed after 3 retries Caused by: Failed to download 20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz Caused by: error sending request for url (20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz) Caused by: client error (SendRequest) Caused by: connection error Caused by: connection reset ``` I don't know how to test that from inside Rust. Fix #14171 (again, hopefully)	2025-09-04 14:45:00 +02:00
Charlie Marsh	580bc9d079	Avoid erroring when match-runtime target is optional (#15671) ... ## Summary If the package that has the `match-runtime` dependency itself isn't being installed, we should avoid erroring if the package it _depends on_ isn't in the resolution. Closes https://github.com/astral-sh/uv/issues/15661.	2025-09-04 08:34:53 -04:00
github-actions[bot]	4162005df8	Sync latest Python releases (#15670) ... Automated update for Python releases. Co-authored-by: zanieb <2586601+zanieb@users.noreply.github.com>	2025-09-03 20:04:55 -05:00
timrid	330e56e778	Support iOS platform tags (#15640) ... ## Summary This implements the iOS part of https://github.com/astral-sh/uv/issues/8029 FYI: @freakboy3742 <!-- What's the purpose of the change? What does it do, and why? --> ## Test Plan Create a venv with uv and run `cargo run pip install --python-platform arm64-apple-ios pillow`. Then the iOS binary of pillow should be installed inside the venv.	2025-09-03 18:24:48 -04:00
Zanie Blue	50bfa8a689	Add logging of incompatible tags on satisfies check (#15663) ... I was trying to understand https://github.com/astral-sh/uv/issues/9559 and think we need more logs to see what's going on.	2025-09-03 11:45:49 -05:00
timrid	d178e45368	Support Android platform tags (#15646) ... ## Summary This implements the Android part of https://github.com/astral-sh/uv/issues/8029 FYI: @freakboy3742 @mhsmith <!-- What's the purpose of the change? What does it do, and why? --> ## Test Plan Create a venv with uv and run `cargo run pip install --python-platform aarch64-linux-android pybase64`. Then the Android binary of pybase64 should be installed inside the venv.	2025-09-03 10:24:33 -04:00
konsti	a94f7d0847	Clarify that uv auth commands take a URL (#15664) ... From the previous description I tried `uv auth token pyx`, which didn't work. --------- Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-09-03 14:16:16 +00:00
Charlie Marsh	8473ecba11	Require HTTPS for CDN requests (#15660) ... ## Summary This should arguably enforce same-realm (as the API), but this is a good guardrail for now.	2025-09-03 13:32:12 +00:00
Charlie Marsh	ad35d120d6	Make uv auth dir service-aware (#15649) ... ## Summary This got lost when https://github.com/astral-sh/uv/pull/15637 was merged into not-`main`.	2025-09-02 22:58:59 -04:00
Charlie Marsh	70cb0df7c2	Bump version to v0.8.15 (#15648)	2025-09-03 02:10:58 +00:00
Charlie Marsh	4e48d759c4	Add zstandard support for wheels (#15645) ... ## Summary This PR allows pyx to send down hashes for zstandard-compressed tarballs. If the hash is present, then the file is assumed to be present at `${wheel_url}.tar.zst`, similar in design to PEP 658 `${wheel_metadata}.metadata` files. The intent here is that the index must include the wheel (to support all clients and support random-access), but can optionally include a zstandard-compressed version alongside it.	2025-09-03 01:38:31 +00:00
Charlie Marsh	7606f1ad3c	Add uv publish --dry-run (#15638) ... ## Summary `uv publish --dry-run` will perform the `--check-url` validation, and hit the `/validate` endpoint if the registry is known to support fast-path validation (like pyx). The `/validate` endpoint lets us validate an upload without uploading the file _contents_, which lets you skip the expensive step for common mistakes. In the future, my hope is that the `/validate` step will deprecated in favor of Upload API 2.0.	2025-09-02 21:24:31 -04:00
Charlie Marsh	b57ad179b6	Allow registries to pre-provide core metadata (#15644) ... ## Summary This PR adds support for the `application/vnd.pyx.simple.v1` content type, similar to `application/vnd.pypi.simple.v1` with the exception that it can also include core metadata for package-versions directly.	2025-09-03 00:56:29 +00:00
Charlie Marsh	f88aaa8740	Add pyx support to uv auth commands (#15636) ... ## Summary This PR adds support for pyx to `uv auth login`, `uv auth logout`, and `uv auth token`. These are generic uv commands that can be used to store credentials for arbitrary indexes and other URLs, but we include a fast-path for pyx that initiates the appropriate login or logout flow.	2025-09-02 18:18:09 -04:00
Zanie Blue	f9e98d1fb6	Allow providing the uv auth login password or token via stdin (#15642)	2025-09-02 16:59:58 -05:00