5611 commits

Author	SHA1	Message	Date
Brendan	cbcf51391f	fix: refresh activation scripts from upstream virtualenv (#15272) ... ## Summary This refreshes the venv activation scripts from upstream `virtualenv` project. This was largely triggered by a problem in the activate.nu script (for nushell): - #14888 - #14914 - #14917 I was careful to respect the git history going back to astral-sh/uv#3376 (the last time this was done). Actually I looked at the complete history from back when this `uv-virtualenv` crate was named after a Pokémon (⁉️), but I found nothing (about activation scripts) from back then that hasn't been overwritten since. ### Some post-processing was involved - Retained license info at top of scripts - Retained template vars (eg `{{ BIN_PATH }}`) to assure current support toward relocatable venv - Retained deviation from upstream in astral-sh/uv#5640. This seems to be the only deviation that isn't in sync with upstream. ### Notable changes from upstream - (omitted due to undesirable complexity) pypa/virtualenv#2928 and its follow-up pypa/virtualenv#2940 - pypa/virtualenv#2910 (what prompted astral-sh/uv#14917 from astral-sh/uv#14888) ## Test Plan There was a request in #14917 to add unit tests to detect breakage or errors. I have added a CI job that runs the nushell activation script. But I think it is better to have the CI test all/most supported shells. See also #15294 I have tested this locally using - [x] nushell (v0.106.1) - [x] cmd.exe (Microsoft Windows [Version 10.0.26100.4946]) - [x] bash in WSL (GNU bash, version 5.1.16(1)-release (x86_64-pc-linux-gnu)) - [x] pwsh (PSVersion 5.1.26100.4768)	2025-09-05 16:12:37 -05:00
Jorge Hermo	c59ead398d	Allow uv format in unmanaged projects (#15553) ... Closes #15550 --------- Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-09-05 13:14:41 -05:00
Ahmed Ilyas	6eefde28e7	Support --with-requirements script.py and -r script.py to include inline dependency metadata from another script (#12763) ... ## Summary Closes #6542 ## Test Plan `cargo test`	2025-09-05 11:45:46 -05:00
Zanie Blue	e136a51f3d	Skip Python interpreters that cannot be queried with permission errors (#15685) ... Closes https://github.com/astral-sh/uv/issues/15651	2025-09-05 09:03:41 -05:00
konsti	549fb121ba	Support recursive requirements and constraints inclusion (#15657) ... uv currently panics with a stack overflow when requirements or constraints are recursively included. Instead, we ignore files we have already seen. The one complexity here is that we have to track whether we're in a requirements inclusion or in a constraints inclusion, to allow including a file separately for requirements and for constraints, and to handle `-r` inside or `-c` (which we treat as constraints too). Fixes #15650	2025-09-05 11:20:12 +02:00
konsti	4a1813f228	Extract IO errors from h2 for streaming retries of Connection Reset (#15675) ... Our streaming retries were missing connection reset errors as h2 was shadowing IO errors (https://github.com/hyperium/h2/issues/862). **Test plan** In one terminal: ``` cargo python uninstall 3.12 && cargo run python install 3.12 -vv ``` In another: ``` sudo tcpkill -i wlp2s0 port 443 ``` Output: ``` error: Failed to install cpython-3.12.11-linux-x86_64-gnu Caused by: Request failed after 3 retries Caused by: Failed to download 20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz Caused by: error sending request for url (20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz) Caused by: client error (SendRequest) Caused by: connection error Caused by: connection reset ``` I don't know how to test that from inside Rust. Fix #14171 (again, hopefully)	2025-09-04 14:45:00 +02:00
Charlie Marsh	580bc9d079	Avoid erroring when match-runtime target is optional (#15671) ... ## Summary If the package that has the `match-runtime` dependency itself isn't being installed, we should avoid erroring if the package it _depends on_ isn't in the resolution. Closes https://github.com/astral-sh/uv/issues/15661.	2025-09-04 08:34:53 -04:00
github-actions[bot]	4162005df8	Sync latest Python releases (#15670) ... Automated update for Python releases. Co-authored-by: zanieb <2586601+zanieb@users.noreply.github.com>	2025-09-03 20:04:55 -05:00
timrid	330e56e778	Support iOS platform tags (#15640) ... ## Summary This implements the iOS part of https://github.com/astral-sh/uv/issues/8029 FYI: @freakboy3742 <!-- What's the purpose of the change? What does it do, and why? --> ## Test Plan Create a venv with uv and run `cargo run pip install --python-platform arm64-apple-ios pillow`. Then the iOS binary of pillow should be installed inside the venv.	2025-09-03 18:24:48 -04:00
Zanie Blue	50bfa8a689	Add logging of incompatible tags on satisfies check (#15663) ... I was trying to understand https://github.com/astral-sh/uv/issues/9559 and think we need more logs to see what's going on.	2025-09-03 11:45:49 -05:00
timrid	d178e45368	Support Android platform tags (#15646) ... ## Summary This implements the Android part of https://github.com/astral-sh/uv/issues/8029 FYI: @freakboy3742 @mhsmith <!-- What's the purpose of the change? What does it do, and why? --> ## Test Plan Create a venv with uv and run `cargo run pip install --python-platform aarch64-linux-android pybase64`. Then the Android binary of pybase64 should be installed inside the venv.	2025-09-03 10:24:33 -04:00
konsti	a94f7d0847	Clarify that uv auth commands take a URL (#15664) ... From the previous description I tried `uv auth token pyx`, which didn't work. --------- Co-authored-by: Zanie Blue <contact@zanie.dev>	2025-09-03 14:16:16 +00:00
Charlie Marsh	8473ecba11	Require HTTPS for CDN requests (#15660) ... ## Summary This should arguably enforce same-realm (as the API), but this is a good guardrail for now.	2025-09-03 13:32:12 +00:00
Charlie Marsh	ad35d120d6	Make uv auth dir service-aware (#15649) ... ## Summary This got lost when https://github.com/astral-sh/uv/pull/15637 was merged into not-`main`.	2025-09-02 22:58:59 -04:00
Charlie Marsh	70cb0df7c2	Bump version to v0.8.15 (#15648)	2025-09-03 02:10:58 +00:00
Charlie Marsh	4e48d759c4	Add zstandard support for wheels (#15645) ... ## Summary This PR allows pyx to send down hashes for zstandard-compressed tarballs. If the hash is present, then the file is assumed to be present at `${wheel_url}.tar.zst`, similar in design to PEP 658 `${wheel_metadata}.metadata` files. The intent here is that the index must include the wheel (to support all clients and support random-access), but can optionally include a zstandard-compressed version alongside it.	2025-09-03 01:38:31 +00:00
Charlie Marsh	7606f1ad3c	Add uv publish --dry-run (#15638) ... ## Summary `uv publish --dry-run` will perform the `--check-url` validation, and hit the `/validate` endpoint if the registry is known to support fast-path validation (like pyx). The `/validate` endpoint lets us validate an upload without uploading the file _contents_, which lets you skip the expensive step for common mistakes. In the future, my hope is that the `/validate` step will deprecated in favor of Upload API 2.0.	2025-09-02 21:24:31 -04:00
Charlie Marsh	b57ad179b6	Allow registries to pre-provide core metadata (#15644) ... ## Summary This PR adds support for the `application/vnd.pyx.simple.v1` content type, similar to `application/vnd.pypi.simple.v1` with the exception that it can also include core metadata for package-versions directly.	2025-09-03 00:56:29 +00:00
Charlie Marsh	f88aaa8740	Add pyx support to uv auth commands (#15636) ... ## Summary This PR adds support for pyx to `uv auth login`, `uv auth logout`, and `uv auth token`. These are generic uv commands that can be used to store credentials for arbitrary indexes and other URLs, but we include a fast-path for pyx that initiates the appropriate login or logout flow.	2025-09-02 18:18:09 -04:00
Zanie Blue	f9e98d1fb6	Allow providing the uv auth login password or token via stdin (#15642)	2025-09-02 16:59:58 -05:00
Zanie Blue	63b93a1db0	Add test cases for URL matching with the native keyring (#15641)	2025-09-02 16:56:40 -05:00
github-actions[bot]	8fcd88d2d4	Sync latest Python releases (#15631) ... Update to python-build-standalone 20250902 mostly for SQLite 3.50.4/CVE-2025-6965.	2025-09-02 18:43:17 +00:00
Zanie Blue	45946b80b0	Allow storage of multiple usernames per service in the plaintext store (#15628) ... We weren't keying our hash map with the username, which meant that only one user could be used per service.	2025-09-02 13:16:52 -05:00
Zanie Blue	709e0ba238	Remove the native system store from the keyring providers (#15612) ... We're not sure what the best way to expose the native store to users is yet and it's a bit weird that you can use this in the `uv auth` commands but can't use any of the other keyring provider options. The simplest path forward is to just not expose it to users as a keyring provider, and instead frame it as a preview alternative to the plaintext uv credentials store. We can revisit the best way to expose configuration before stabilization. Note this pull request retains the _internal_ keyring provider implementation — we can refactor it out later but I wanted to avoid a bunch of churn here.	2025-09-02 13:16:52 -05:00
Zanie Blue	bc1bbfb066	Respect usernames when finding matching credentials in the plaintext store (#15620) ... We're not respecting the username when searching for a match, which is no good!	2025-09-02 13:16:52 -05:00
Zanie Blue	7ac957af8f	Lock the credentials store when reading or writing (#15610) ... Adds locking of the credentials store for concurrency safety. It's important to hold the lock from read -> write so credentials are not dropped during concurrent writes. I opted not to attach the lock to the store itself. Instead, I return the lock on read and require it on write to encourage safe use. Maybe attaching the source path to the store struct and adding a `lock(&self)` method would make sense? but then you can forget to take the lock at the right time. The main problem with the interface here is to write a _new_ store you have to take the lock yourself, and you could make a mistake by taking a lock for the wrong path or something. The fix for that would be to introduce a new `CredentialStoreHandle` type or something, but that seems overzealous rn. We also don't eagerly drop the lock on token read, although we could.	2025-09-02 13:16:52 -05:00
Zanie Blue	7d627b50ef	Add uv auth dir (#15600)	2025-09-02 13:16:52 -05:00
Charlie Marsh	e3cb13868d	Use a dedicated wire type for credentials serialization (#15599) ... This is a little closer to what we do elsewhere when we want to encapsulate differences in the serialization format.	2025-09-02 13:16:52 -05:00
Charlie Marsh	7d9446450b	Misc. tweaks	2025-09-02 13:16:52 -05:00
Zanie Blue	a13fb3ec64	Respect UV_CREDENTIALS_DIR (#15598)	2025-09-02 13:16:52 -05:00
Zanie Blue	0b5180cb37	Strip the trailing /simple from index URLs provided to uv auth login (#15591) ... I'm pretty sure we need to do this for robust lookups of URLs served by indexes.	2025-09-02 13:16:52 -05:00
Zanie Blue	ac5dc9be1f	Add a plain text backend for credential storage (#15588) ... Adds a default plain text storage mechanism to `uv auth`. While we'd prefer to use the system store, the "native" keyring support is experimental still and I don't want to ship an unusable interface. @geofft also suggested that the story for secure credential storage is much weaker on Linux than macOS and Windows and felt this approach would be needed regardless. We'll switch over to using the native keyring by default in the future. On Linux, we can now fallback to a plaintext store the secret store is not configured, which is a nice property. Right now, we store credentials in a TOML file in the uv state directory. I expect to also read from the uv config directory in the future, but we don't need it immediately.	2025-09-02 13:16:52 -05:00
Zanie Blue	ddf2f5ed8c	Remove unused dependencies from uv auth preview refactor (#15589)	2025-09-02 13:16:52 -05:00
Zanie Blue	7162085846	Update messaging for uv auth (#15573) ... To clarify that we are not validating the credentials	2025-09-02 13:16:52 -05:00
Zanie Blue	a68007aa61	Update uv auth snapshots	2025-09-02 13:16:52 -05:00
Zanie Blue	f9e974c1f9	Only allow HTTPS services in login for now (#15559)	2025-09-02 13:16:52 -05:00
Zanie Blue	a1cc12af2b	Add support for credentials in URLs to uv auth (#15554) ... Allows cases like `uv auth login https://username:password@example.com` for coherence with the rest of our interfaces.	2025-09-02 13:16:52 -05:00
Zanie Blue	4ad5ae5e6f	Add preview warnings to native-keyring usage (#15555) ... The refactor here was all done by Claude Code.	2025-09-02 13:16:52 -05:00
Zanie Blue	460ea6e9eb	Add uv auth commands (login, logout, and token) (#15539) ... Picks up the work from - #14559 - https://github.com/astral-sh/uv/pull/14896 There are some high-level changes from those pull requests 1. We do not stash seen credentials in the keyring automatically 2. We use `auth login` and `auth logout` (for future consistency) 3. We add a `token` command for showing the credential that will be used As well as many smaller changes to API, messaging, testing, etc. --------- Co-authored-by: John Mumm <jtfmumm@gmail.com>	2025-09-02 13:16:52 -05:00
Jo Shields	f76e0fe5e6	Add --python-platform riscv64-unknown-linux to various commands (#15630) ... ## Summary We (and I'm sure many others) are currently doing a lot of RISC-V work in QEMU. It is possible to significantly improve the speed of Python-related builds by taking care of the environment setup using an AMD64 `uv` binary (bypassing binfmt/qemu-system emulation). Some approx numbers from local testing in riscv64 Ubuntu in QEMU: | Resolver arch | Command | Time | | --- | --- | --- | | riscv64 | `pip install --upgrade --break-system-packages --index-url=https://gitlab.com/api/v4/projects/riseproject%2Fpython%2Fwheel_builder/packages/pypi/simple openai-harmony` | 15s | | riscv64 | `uv pip install --upgrade --system --break-system-packages --index-url=https://gitlab.com/api/v4/projects/riseproject%2Fpython%2Fwheel_builder/packages/pypi/simple openai-harmony` | 5s | | amd64 | `uv pip install --python-platform=riscv64-unknown-linux --upgrade --system --break-system-packages --index-url=https://gitlab.com/api/v4/projects/riseproject%2Fpython%2Fwheel_builder/packages/pypi/simple openai-harmony` | 4s | The numbers from some larger internal packages with deeper dependency trees are much more pronounced - 3m6 vs 43s vs 8s, in one example. Manylinux 2.39 is specified, as it's the first (only?) RISC-V manylinux ## Test Plan Locally, in QEMU. `$ docker run --platform linux/riscv64 -it ubuntu:latest`, get amd64 libc into LD_LIBRARY_PATH, tests as above	2025-09-02 13:17:30 -04:00
github-actions[bot]	35ce8e1dae	Sync latest Python releases (#15578) ... Automated update for Python releases. Co-authored-by: zanieb <2586601+zanieb@users.noreply.github.com>	2025-09-02 14:24:39 +00:00
Michał Górny	4aaf71a38a	Fix python_module test failures w/ system Python and installed uv (#15611) ... ## Summary Override `sys.base_prefix` when performing `python_module` tests, in order to prevent `find_uv_bin()` from finding `uv` installed alongside system Python, and therefore fix test failures on Gentoo. Fixes #15368 ## Test Plan ``` cargo test --profile=fast-build --features git --features pypi --features python --no-default-features --test it python_module ``` Signed-off-by: Michał Górny <mgorny@gentoo.org>	2025-09-02 08:45:14 -05:00
konsti	d5bcc0535a	Add test case for status code retries (#15617) ... When migrating from the `reqwest_retry` crate, we want to ensure that the status codes we retry stay the same. This also helps us to intentionally migrate to a different list later, by enumerating the list of status codes that are retried.	2025-09-02 15:41:54 +02:00
konsti	19e19d5795	Add error trace to invalid package format (#15626) ... In https://github.com/astral-sh/uv/issues/11636, we're getting reports for installation flakes that report an invalid package format for what appears to be a network problem. Since we're cutting the error reporting to the first error message in the chain, we're not reporting the actual network error underneath it. This PR displays the whole error chain for invalid package format errors, so we can debug and eventually catch-and-retry https://github.com/astral-sh/uv/issues/11636.	2025-09-02 15:22:42 +02:00
Charlie Marsh	d70ea34d45	Fix settings rendering for extra-build-dependencies (#15622) ... ## Summary This was fixed in https://github.com/astral-sh/uv/pull/15161, then reverted as it regressed the error handling. I've re-applied the change here, but moved the error handling to the runtime, rather than parse-time. I think this is slightly worse in that we no longer include the originating source code snippet, but it at least gives us the expected behavior :( Closes https://github.com/astral-sh/uv/issues/15124.	2025-09-02 09:06:21 -04:00
adamnemecek	9be016f3f8	refactored IndexUrl (#15613)	2025-09-01 09:28:42 +02:00
adamnemecek	36216363eb	Refactored Refresh::combine (#15609)	2025-08-31 12:18:58 -05:00
konsti	22f80ca00d	Retry streaming Python and bin download errors (#15567) ... When there is an error during the streaming download and unpack for Python interpreter and bin installs, we would previously fail, causing a lot of CI flakes on GitHub Actions. The problem was that the error is not one of the extended IO errors we were previously handling, but a regular reqwest error, nested below layers of errors of other crates processing the stream, including some IO errors. We now handle nested reqwest errors, too. This surfaced another problem: Our manual retry loop couldn't inform the retry middleware that it already performed the limit of retries, and that the middleware should not retry anymore. While too many retries are more a problem for debugging than for the user, this causes confusing error output. To work around this, we disable the retries in the client and handle all retry errors in our loop. Fixes https://github.com/astral-sh/uv/issues/14171 Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>	2025-08-31 15:07:22 +00:00
Charlie Marsh	01e5195ef3	Skip non-existent directories in bytecode compilation (#15608) ... ## Summary Closes https://github.com/astral-sh/uv/issues/15577.	2025-08-31 14:53:00 +00:00
Zsolt Dollenstein	c2c713e5d2	fix ecosystem::transformers test (#15605) ... ## Summary This test is broken because faiss-1.8.0.post1's sdist was deleted(?) from [pypi](https://pypi.org/project/faiss-cpu/1.8.0.post1/#files).	2025-08-31 11:55:59 +01:00