Commit graph

6399 commits

Author SHA1 Message Date
Ahmed Ilyas
f872917d33
Refactor ExtraSpecification to support default-extras (#12964)
## Summary

Part of #8607. This is a pure refactor aimed at paving the way for
supporting the `default-extras` configuration in the `pyproject.toml`
file.

The `ExtraSpecification` struct has been refactored to align more
closely with the
[`DependencyGroups`](256b100a9e/crates/uv-configuration/src/dependency_groups.rs (L9))
struct.

## Test Plan

Existing tests.
2025-04-28 13:30:14 -04:00
konsti
85d8b07026
Remove flyte-short-incompatible benchmark for too many false positives (#13181)
The benchmark has recurring false positives
(https://github.com/astral-sh/uv/issues?q=flyte-short-incompatible%20),
so we're removing it.
2025-04-28 18:01:34 +02:00
Charlie Marsh
bb0158d005
Use upload-time rather than upload_time in uv.lock (#13176)
## Summary

In https://github.com/astral-sh/uv/pull/12968, we added support for
upload time to `uv.lock`, but stylized as `upload_time`. The other keys
in `uv.lock` use kebab casing, as in common in Python formats, so this
really should've been `upload-time`. I want to change it ASAP to
minimize churn for users. Any users that already upgraded will of course
experience churn in their files a second time. But if we don't change it
now, we'll only increase the surface area of affected users.

So, this PR uses `upload-time` instead, but continues reading
`upload_time` to make it non-breaking.
2025-04-28 11:01:17 -04:00
renovate[bot]
37bd1d9547
Update Rust crate rustix to v1 (#13168)
Some checks are pending
CI / integration test | uv_build (push) Blocked by required conditions
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on ubuntu (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | python on macos aarch64 (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python on macos x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
2025-04-28 08:49:51 -04:00
renovate[bot]
f8f1b9c505
Update taiki-e/install-action action to v2.50.3 (#13161) 2025-04-28 08:48:37 -04:00
renovate[bot]
6402f98cbd
Update Rust crate windows to 0.61.0 (#13159)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [windows](https://redirect.github.com/microsoft/windows-rs) |
dependencies | minor | `0.59.0` -> `0.61.0` |

---

### Release Notes

<details>
<summary>microsoft/windows-rs (windows)</summary>

###
[`v0.61.0`](https://redirect.github.com/microsoft/windows-rs/releases/tag/0.61.0)

[Compare
Source](https://redirect.github.com/microsoft/windows-rs/compare/0.60.0...0.61.0)

Major crate updates:

-   `windows` 0.59.0
-   `windows-core` 0.59.0
    -   `windows-implement` 0.59.0
    -   `windows-interface` 0.59.0
-   `windows-targets` 0.53.0
    -   `windows_i686_msvc` 0.53.0
    -   `windows_x86_64_msvc` 0.53.0
    -   `windows_aarch64_msvc` 0.53.0
    -   `windows_i686_gnu` 0.53.0
    -   `windows_x86_64_gnu` 0.53.0
    -   `windows_i686_gnullvm` 0.53.0
    -   `windows_x86_64_gnullvm` 0.53.0
    -   `windows_aarch64_gnullvm` 0.53.0
-   `windows-bindgen` 0.59.0
-   `windows-registry` 0.4.0
-   `windows-result` 0.3.0
-   `windows-strings` 0.3.0
-   `cppwinrt` 0.2.0

Minor crate updates:

-   `windows-version` 0.1.2

Excluded:

-   `windows-sys` 0.59.0

Things to keep in mind:

- The tag/release names no longer map directly to the crate versions, so
to [find
samples](https://redirect.github.com/microsoft/windows-rs/tree/master/crates/samples)
for a particular release requires looking at [the
releases](https://redirect.github.com/microsoft/windows-rs/releases)
page and finding the release that most recently updated a particular
crate.

- The `windows-bindgen` crate includes the major code generation
overhaul that brings many improvements - be sure to check out the PR
description for more information. The resulting code gen depends on the
new version of `windows-core` and its dependencies, unless you include
the `--sys` option.
[#&#8203;3359](https://redirect.github.com/microsoft/windows-rs/issues/3359)

- The `cppwinrt` crate constitutes a major update due to streamlining
the error handling.
[#&#8203;3415](https://redirect.github.com/microsoft/windows-rs/issues/3415)

- The `windows-registry`, `windows-strings,` and `windows-result` crates
are also major version updates since they include small breaking
changes.

- The `windows-targets` crate finally receives a major version update,
the first in over a year. This is due to
[#&#8203;3359](https://redirect.github.com/microsoft/windows-rs/issues/3359)
and
[#&#8203;3342](https://redirect.github.com/microsoft/windows-rs/issues/3342)
potentially introducing breaking changes. Although unlikely, these
updates introduced sufficient changes that make it hard to ensure that
the `windows-targets` libs don't break existing code. As we're updating
`windows-targets` anyway, I took the liberty to bump the MSRV to 1.60 -
to match the latest version of `windows-sys` - and remove the old but
unused doc macro feature. Both remained for compatibility with very old
dependents of the `windows-targets` crate.

- The `windows-version` crate receives a minor update to update its
dependency on the `windows-targets` crate.

- Beyond these specifics, this update is the culmination of around 6
months worth of work on the `windows-rs` project. The biggest
improvements comes from the new code generation engine, but many other
improvements are now also available for production. This includes
support for many new lints, warnings, and suggestions provided by the
Rust toolchain; much smaller code gen thanks to deriving many more
traits; more efficient code gen; major improvements to WinRT type system
and implementation support; more robust and consistent error handling;
stock collection and async support; improved support for class
hierarchies; and much more!

In addition to "what's changed" below, check out what's changed for
notes for
[0.60.0](https://redirect.github.com/microsoft/windows-rs/releases/tag/0.60.0)
and
[0.59.0](https://redirect.github.com/microsoft/windows-rs/releases/tag/0.59.0)
for additional changes that roll up to the crates published as part of
this release.

#### What's Changed

- Remove improper_ctypes workaround by
[@&#8203;ChrisDenton](https://redirect.github.com/ChrisDenton) in
[https://github.com/microsoft/windows-rs/pull/3296](https://redirect.github.com/microsoft/windows-rs/pull/3296)
- Bump rollup from 2.79.1 to 2.79.2 in /web/features by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3299](https://redirect.github.com/microsoft/windows-rs/pull/3299)
- Update jsonschema requirement from 0.20 to 0.21 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3301](https://redirect.github.com/microsoft/windows-rs/pull/3301)
- Address Rust nightly compiler warnings by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3311](https://redirect.github.com/microsoft/windows-rs/pull/3311)
- Update jsonschema requirement from 0.21 to 0.22 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3310](https://redirect.github.com/microsoft/windows-rs/pull/3310)
- Update workflows to ignore paths on pull request by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3312](https://redirect.github.com/microsoft/windows-rs/pull/3312)
- Fix remaining `std` references in `windows` and `windows-core` crates
for `no_std` builds by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3317](https://redirect.github.com/microsoft/windows-rs/pull/3317)
- Bump cookie and express in /web/features by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3318](https://redirect.github.com/microsoft/windows-rs/pull/3318)
- Fix nested struct sort order by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3321](https://redirect.github.com/microsoft/windows-rs/pull/3321)
- Update jsonschema requirement from 0.22 to 0.23 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3323](https://redirect.github.com/microsoft/windows-rs/pull/3323)
- Add `unwrap` helper for `NTSTATUS` by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3324](https://redirect.github.com/microsoft/windows-rs/pull/3324)
- Bump http-proxy-middleware from 2.0.6 to 2.0.7 in /web/features by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3331](https://redirect.github.com/microsoft/windows-rs/pull/3331)
- Remove "implement" feature by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3333](https://redirect.github.com/microsoft/windows-rs/pull/3333)
- Update web workflow by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3344](https://redirect.github.com/microsoft/windows-rs/pull/3344)
- Update Windows metadata by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3342](https://redirect.github.com/microsoft/windows-rs/pull/3342)
- Bump cross-spawn from 7.0.3 to 7.0.6 in /web/features by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3347](https://redirect.github.com/microsoft/windows-rs/pull/3347)
- fix: remove use of std in windows-strings h! macro by
[@&#8203;vthib](https://redirect.github.com/vthib) in
[https://github.com/microsoft/windows-rs/pull/3356](https://redirect.github.com/microsoft/windows-rs/pull/3356)
- Major `windows-bindgen` update by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3359](https://redirect.github.com/microsoft/windows-rs/pull/3359)
- Harden reg-free class activation by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3365](https://redirect.github.com/microsoft/windows-rs/pull/3365)
- Simpler bindings generation by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3367](https://redirect.github.com/microsoft/windows-rs/pull/3367)
- `windows-bindgen` should generate `no_std` bindings by default by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3366](https://redirect.github.com/microsoft/windows-rs/pull/3366)
- Prefer optional over convertible parameters by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3368](https://redirect.github.com/microsoft/windows-rs/pull/3368)
- Remove unused extensions by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3369](https://redirect.github.com/microsoft/windows-rs/pull/3369)
- Simpler code generation by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3370](https://redirect.github.com/microsoft/windows-rs/pull/3370)
- Update dependencies by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3374](https://redirect.github.com/microsoft/windows-rs/pull/3374)
- Simpler code gen for Boolean parameters by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3373](https://redirect.github.com/microsoft/windows-rs/pull/3373)
- Remap `BOOLEAN` to `bool` by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3376](https://redirect.github.com/microsoft/windows-rs/pull/3376)
- Avoid generating `transmute` for input value type parameter bindings
by [@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3377](https://redirect.github.com/microsoft/windows-rs/pull/3377)
- Fix macro docs by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3378](https://redirect.github.com/microsoft/windows-rs/pull/3378)
- Streamline error handling in `windows-bindgen` by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3379](https://redirect.github.com/microsoft/windows-rs/pull/3379)
- Improve WinRT event representation and testing by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3382](https://redirect.github.com/microsoft/windows-rs/pull/3382)
- Use `track_caller` to make debugging `bindgen` build script errors
easier by [@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3383](https://redirect.github.com/microsoft/windows-rs/pull/3383)
- `windows-bindgen` now uses `Ref` and `OutRef` for COM interface traits
by [@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3386](https://redirect.github.com/microsoft/windows-rs/pull/3386)
- Add static event test/sample for WinRT by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3389](https://redirect.github.com/microsoft/windows-rs/pull/3389)
- Verify param direction by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3390](https://redirect.github.com/microsoft/windows-rs/pull/3390)
- Ensure external references to static factories are generated correctly
by [@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3392](https://redirect.github.com/microsoft/windows-rs/pull/3392)
- Update `windows-bindgen` to support `unsafe_op_in_unsafe_fn` by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3393](https://redirect.github.com/microsoft/windows-rs/pull/3393)
- Make `Ref` work with more than just interface types by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3394](https://redirect.github.com/microsoft/windows-rs/pull/3394)
- Add PR preview deployments to web workflow by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3395](https://redirect.github.com/microsoft/windows-rs/pull/3395)
- Adjust web workflow to use gh-pages branch by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3397](https://redirect.github.com/microsoft/windows-rs/pull/3397)
- Streamline CRA deps and webpack config by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3396](https://redirect.github.com/microsoft/windows-rs/pull/3396)
- Address nightly clippy warnings about operator precedence by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3414](https://redirect.github.com/microsoft/windows-rs/pull/3414)
- Detect unsupported array parameters by
[@&#8203;iancormac84](https://redirect.github.com/iancormac84) in
[https://github.com/microsoft/windows-rs/pull/3402](https://redirect.github.com/microsoft/windows-rs/pull/3402)
- `cppwinrt` should consistently panic on failure by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3415](https://redirect.github.com/microsoft/windows-rs/pull/3415)
- Shorten sample crate names by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3416](https://redirect.github.com/microsoft/windows-rs/pull/3416)
- Use `track_caller` to make debugging `cppwinrt` build script errors
easier by [@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3417](https://redirect.github.com/microsoft/windows-rs/pull/3417)
- Fix provenance in direct32 sample by
[@&#8203;ChrisDenton](https://redirect.github.com/ChrisDenton) in
[https://github.com/microsoft/windows-rs/pull/3419](https://redirect.github.com/microsoft/windows-rs/pull/3419)
- Update web workflow to use external origin by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3420](https://redirect.github.com/microsoft/windows-rs/pull/3420)
- Avoid `transmute` where possible by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3421](https://redirect.github.com/microsoft/windows-rs/pull/3421)
- Update GitHub Actions runners by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3423](https://redirect.github.com/microsoft/windows-rs/pull/3423)
- Improve feature search UX, add dark mode, and update deps by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3422](https://redirect.github.com/microsoft/windows-rs/pull/3422)
- Release 0.61.0 by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3418](https://redirect.github.com/microsoft/windows-rs/pull/3418)

#### New Contributors

- [@&#8203;iancormac84](https://redirect.github.com/iancormac84) made
their first contribution in
[https://github.com/microsoft/windows-rs/pull/3402](https://redirect.github.com/microsoft/windows-rs/pull/3402)

**Full Changelog**:
https://github.com/microsoft/windows-rs/compare/0.60.0...0.61.0

###
[`v0.60.0`](https://redirect.github.com/microsoft/windows-rs/releases/tag/0.60.0)

[Compare
Source](https://redirect.github.com/microsoft/windows-rs/compare/0.59.0...0.60.0)

This release includes an update to the
[windows-registry](https://crates.io/crates/windows-registry) and
[windows-strings](https://crates.io/crates/windows-strings) crates,
mainly to provide various improvements to registry support for
[rustup](https://redirect.github.com/rust-lang/rustup).

#### What's Changed

- Add precise registry types and allocation-free queries and updates by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3184](https://redirect.github.com/microsoft/windows-rs/pull/3184)
- Add registry `Value` to/from `HSTRING` conversion by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3190](https://redirect.github.com/microsoft/windows-rs/pull/3190)
- Replace `From<&str>` for `GUID` with `TryFrom<&str>` by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3193](https://redirect.github.com/microsoft/windows-rs/pull/3193)
- Remove uneeded feature dependencies by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3201](https://redirect.github.com/microsoft/windows-rs/pull/3201)
- docs: add root level documentation for all libraries by
[@&#8203;Nerixyz](https://redirect.github.com/Nerixyz) in
[https://github.com/microsoft/windows-rs/pull/3202](https://redirect.github.com/microsoft/windows-rs/pull/3202)
- Cleanup doc testing by
[@&#8203;Nerixyz](https://redirect.github.com/Nerixyz) in
[https://github.com/microsoft/windows-rs/pull/3205](https://redirect.github.com/microsoft/windows-rs/pull/3205)
- Revert cfg doc by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3206](https://redirect.github.com/microsoft/windows-rs/pull/3206)
- Remove workaround for "unused" private fields by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3207](https://redirect.github.com/microsoft/windows-rs/pull/3207)
- Immutable Event implementation by
[@&#8203;lifers](https://redirect.github.com/lifers) in
[https://github.com/microsoft/windows-rs/pull/3198](https://redirect.github.com/microsoft/windows-rs/pull/3198)
- Always treat warnings as errors by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3210](https://redirect.github.com/microsoft/windows-rs/pull/3210)
- Consistent allocation failure handling by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3209](https://redirect.github.com/microsoft/windows-rs/pull/3209)
- Improve class hierarchy support by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3212](https://redirect.github.com/microsoft/windows-rs/pull/3212)
- Consistent allocation failure for stock collections by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3216](https://redirect.github.com/microsoft/windows-rs/pull/3216)
- Consistent allocation failure for `windows-registry` by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3215](https://redirect.github.com/microsoft/windows-rs/pull/3215)
- Add default "std" feature for `windows-registry` crate by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3214](https://redirect.github.com/microsoft/windows-rs/pull/3214)
- Overhaul async and future support by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3213](https://redirect.github.com/microsoft/windows-rs/pull/3213)
- Addressing new nightly Clippy warning by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3222](https://redirect.github.com/microsoft/windows-rs/pull/3222)
- Add async `ready` support by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3221](https://redirect.github.com/microsoft/windows-rs/pull/3221)
- Bump micromatch from 4.0.5 to 4.0.8 in /web/features by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3223](https://redirect.github.com/microsoft/windows-rs/pull/3223)
- Add file dialog sample by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3226](https://redirect.github.com/microsoft/windows-rs/pull/3226)
- Use relative path for extension by
[@&#8203;glandium](https://redirect.github.com/glandium) in
[https://github.com/microsoft/windows-rs/pull/3224](https://redirect.github.com/microsoft/windows-rs/pull/3224)
- Simplify trait bounds for interface implementations by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3227](https://redirect.github.com/microsoft/windows-rs/pull/3227)
- Remove unnecessary closure from generated code by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3228](https://redirect.github.com/microsoft/windows-rs/pull/3228)
- Bump webpack from 5.90.2 to 5.94.0 in /web/features by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3236](https://redirect.github.com/microsoft/windows-rs/pull/3236)
- Add async `spawn` support by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3235](https://redirect.github.com/microsoft/windows-rs/pull/3235)
- Nightly Clippy warning about assumed lifetime by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3243](https://redirect.github.com/microsoft/windows-rs/pull/3243)
- Regenerate GNU libs by
[@&#8203;riverar](https://redirect.github.com/riverar) in
[https://github.com/microsoft/windows-rs/pull/3241](https://redirect.github.com/microsoft/windows-rs/pull/3241)
- Add support for composable constructors by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3246](https://redirect.github.com/microsoft/windows-rs/pull/3246)
- Use workspace dependencies where practical by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3248](https://redirect.github.com/microsoft/windows-rs/pull/3248)
- Add test folders by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3252](https://redirect.github.com/microsoft/windows-rs/pull/3252)
- Improve interop testing by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3253](https://redirect.github.com/microsoft/windows-rs/pull/3253)
- Avoid deriving `Eq` for structs containing floating point type
parameters by [@&#8203;kennykerr](https://redirect.github.com/kennykerr)
in
[https://github.com/microsoft/windows-rs/pull/3255](https://redirect.github.com/microsoft/windows-rs/pull/3255)
- Add test for composable type authoring support by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3259](https://redirect.github.com/microsoft/windows-rs/pull/3259)
- Factory cache statics don't need to be public by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3261](https://redirect.github.com/microsoft/windows-rs/pull/3261)
- Allow `noexcept` methods in a composable hierarchy by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3262](https://redirect.github.com/microsoft/windows-rs/pull/3262)
- Group more of the WinRT tests together by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3263](https://redirect.github.com/microsoft/windows-rs/pull/3263)
- Remove "riddle" and metadata generation by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3266](https://redirect.github.com/microsoft/windows-rs/pull/3266)
- Improvements to `windows-metadata` by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3268](https://redirect.github.com/microsoft/windows-rs/pull/3268)
- We can now derive `Eq` and `PartialEq` for structs containing
callbacks by [@&#8203;kennykerr](https://redirect.github.com/kennykerr)
in
[https://github.com/microsoft/windows-rs/pull/3270](https://redirect.github.com/microsoft/windows-rs/pull/3270)
- Simpler "retval" heuristic by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3271](https://redirect.github.com/microsoft/windows-rs/pull/3271)
- Test error handling for `windows-bindgen` crate by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3272](https://redirect.github.com/microsoft/windows-rs/pull/3272)
- Exclude `web` on most workflows by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3279](https://redirect.github.com/microsoft/windows-rs/pull/3279)
- Bump serve-static and express in /web/features by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3274](https://redirect.github.com/microsoft/windows-rs/pull/3274)
- Update jsonschema requirement from 0.18 to 0.19 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[https://github.com/microsoft/windows-rs/pull/3283](https://redirect.github.com/microsoft/windows-rs/pull/3283)
- Move `VARIANT` support to the `windows` crate by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3282](https://redirect.github.com/microsoft/windows-rs/pull/3282)
- Update `jsonschema` dependency by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3286](https://redirect.github.com/microsoft/windows-rs/pull/3286)
- Expand `raw-dylib` testing by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3287](https://redirect.github.com/microsoft/windows-rs/pull/3287)
- Fix for `cppwinrt` concurrency issue by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3289](https://redirect.github.com/microsoft/windows-rs/pull/3289)
- Address Rust nightly compiler warnings by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3292](https://redirect.github.com/microsoft/windows-rs/pull/3292)
- Add `Deref` implementation for `HSTRING` by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3291](https://redirect.github.com/microsoft/windows-rs/pull/3291)
- Release 0.60.0 by
[@&#8203;kennykerr](https://redirect.github.com/kennykerr) in
[https://github.com/microsoft/windows-rs/pull/3293](https://redirect.github.com/microsoft/windows-rs/pull/3293)

#### New Contributors

- [@&#8203;lifers](https://redirect.github.com/lifers) made their first
contribution in
[https://github.com/microsoft/windows-rs/pull/3198](https://redirect.github.com/microsoft/windows-rs/pull/3198)

**Full Changelog**:
https://github.com/microsoft/windows-rs/compare/0.59.0...0.60.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: konstin <konstin@mailbox.org>
2025-04-28 13:36:29 +02:00
konsti
b33a19689c
Optional managed Python archive download cache (#12175)
Part of #11834

Currently, all Python installation are a streaming download-and-extract.
With this PR, we add the `UV_PYTHON_CACHE_DIR` variable. When set, the
installation is split into downloading the interpreter into
`UV_PYTHON_CACHE_DIR` and extracting it there from a second step. If the
archive is already present in `UV_PYTHON_CACHE_DIR`, we skip the
download.

The feature can be used to speed up tests and CI. Locally for me, `cargo
test -p uv -- python_install` goes from 43s to 7s (1,7s in release mode)
when setting `UV_PYTHON_CACHE_DIR`. It can also be used for offline
installation of Python interpreter, by copying the archives to a
directory in the offline machine, while the path rewriting is still
performed on the target machine on installation.
2025-04-28 12:09:09 +02:00
renovate[bot]
cfe82dc22a
Update EmbarkStudios/cargo-deny-action action to v2 (#13164)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[EmbarkStudios/cargo-deny-action](https://redirect.github.com/EmbarkStudios/cargo-deny-action)
| action | major | `v1` -> `v2.0.11` |

---

### Release Notes

<details>
<summary>EmbarkStudios/cargo-deny-action
(EmbarkStudios/cargo-deny-action)</summary>

###
[`v2.0.11`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.11)

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.10...v2.0.11)

#### \[0.18.2] - 2025-03-10

##### Added

-
[PR#753](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/753)
resolved
[#&#8203;752](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/752)
by adding back the `advisories.unmaintained` config option. See the
[docs](https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html#the-unmaintained-field-optional)
for how it can be used. The default matches the current behavior, which
is to error on any `unmaintained` advisory, but adding `unmaintained =
"workspace"` to the `[advisories]` table will mean unmaintained
advisories will only error if the crate is a direct dependency of your
workspace.

#### \[0.18.1] - 2025-02-27

##### Fixed

-
[PR#749](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/749)
updated `krates` to pull in the fix for
[EmbarkStudios/krates#100](https://redirect.github.com/EmbarkStudios/krates/issues/100).

###
[`v2.0.10`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.10)

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.9...v2.0.10)

-
[PR#96](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/96)
resolved
[#&#8203;94](https://redirect.github.com/EmbarkStudios/cargo-deny-action/issues/94)
by switching to the directory the manifest path is located in and doing
`rustup toolchain install` if `rustup show` failed due to any reason

###
[`v2.0.9`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.9):
Release 2.0.9 - cargo-deny 0.18.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.8...v2.0.9)

-
[`d8395c1`](d8395c1)
removed the rustup update.

###
[`v2.0.8`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.8)

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.7...v2.0.8)

-
[PR#93](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/93)
pins to a hash instead of tag, avoiding future breakage from eg. rustup
changes.

###
[`v2.0.7`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.7):
Release 2.0.7 - cargo-deny 0.18.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.6...v2.0.7)

-
[PR#92](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/92)
fixed an issue introduced by the latest rustup release.

###
[`v2.0.6`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.6):
Release 2.0.6 - cargo-deny 0.18.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.5...v2.0.6)

##### Changed

-
[PR#746](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/746)
changed the directory naming of advisory databases,
[again](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/745),
so the name uses the last path component and a different, but also
stable, hashing algorithm. Eg. the default
`https://github.com/rustsec/advisory-db` will now be placed in
`$CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691`.
-
[PR#746](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/746)
changed the MSRV to 1.85.0 and uses edition 2024.

##### Fixed

-
[PR#746](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/746)
fixes an issue when using cargo 1.85.0 where source urls were not being
properly assigned to crates.io due to the constant being used no longer
matching the new path used in cargo 1.85.0 causing eg. workspace
dependency checks to fail.

###
[`v2.0.5`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.5):
Release 2.0.5 - cargo-deny 0.17.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.4...v2.0.5)

##### Changed

-
[PR#745](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/745)
updated `tame-index` to
[0.18.0](https://redirect.github.com/EmbarkStudios/tame-index/releases/tag/0.18.0)
so that cargo 1.85.0 is transparently supported along with older cargo
versions.
-
[PR#745](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/745)
now uses the same stable hashing as cargo 1.85.0 for the advisory
databases, which changes their path, but will notably now be the same
across all host platforms.

###
[`v2.0.4`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.4):
Release 2.0.4 - cargo-deny 0.16.3

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.3...v2.0.4)

- Update base image to rust 1.83.0 so that version 4 lockfiles are
supported with no config changes

###
[`v2.0.3`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.3):
Release 2.0.3 - cargo-deny 0.16.3

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.2...v2.0.3)

##### Changed

-
[PR#721](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/721)
updated `rust-version` to 1.81.0 to accurately reflect the minimum rust
version required to compile, resolving
[#&#8203;720](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/720).
-
[PR#722](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/722)
updated the SPDX license list to 3.25.0.

##### Fixed

-
[PR#726](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/726)
resolved
[#&#8203;725](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/725)
by adding the `unnecessary-skip` diagnostic, emitted when there is a
`skip` configured for a crate that only has one version in the graph.

###
[`v2.0.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.2):
Release 2.0.2 - cargo-deny 0.16.2

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.1...v2.0.2)

##### Fixed

-
[PR#703](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/703)
resolved
[#&#8203;696](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/696)
by no longer emitting errors when failing to deserialize deprecated
fields, and removed some lingering documentation that wasn't removed in
[PR#611](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/611).
-
[PR#719](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/719)
updated to `krates` -> 0.17.5, fixing an issue where `cargo-deny` could
[panic](https://redirect.github.com/EmbarkStudios/krates/issues/97) due
to [incorrectly
resolving](https://redirect.github.com/EmbarkStudios/krates/issues/84)
features for different versions of the same crate referenced by a single
crate.
-
[PR#719](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/719)
resolved
[#&#8203;706](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/706)
by removing a warning issued when users use ignored scheme modifiers for
source urls.
-
[PR#719](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/719)
resolved
[#&#8203;718](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/718)
by updating the book with missing arguments.

##### Added

-
[PR#715](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/715)
resolved
[#&#8203;714](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/714)
by adding support for Edition 2024. Thanks
[@&#8203;kpcyrd](https://redirect.github.com/kpcyrd)!
-
[PR#710](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/710)
resolved
[#&#8203;708](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/708)
by allowing for unpublished workspace crates to be excluded from the
dependency graph that checks are run against, either via the
`--exclude-unpublished` CLI argument or the `graph.exclude-unpublished`
config field. Thanks
[@&#8203;Tastaturtaste](https://redirect.github.com/Tastaturtaste)!

##### Changed

-
[PR#711](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/711)
updated `goblin` -> 0.9.2
-
[PR#713](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/713)
updated various crates, notably `rustsec` -> 0.30.

###
[`v2.0.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.1):
Release 2.0.1 - cargo-deny 0.16.1

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2...v2.0.1)

##### Fixed

-
[PR#691](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/691)
fixed an issue where workspace dependencies that used the current dir
'.' path component would incorrectly trigger the
`unused-workspace-dependency` lint.

###
[`v2.0.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.0):
Release 2.0.0 - cargo-deny 0.16.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.6.3...v2)

#### `Action`

##### Added

-
[PR#78](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/78)
added SSH support, thanks
[@&#8203;nagua](https://redirect.github.com/nagua)!

##### Changed

- This release includes breaking changes in cargo-deny, so this release
begins the `v2` tag, using `v1` will be stable but not follow future
`cargo-deny` releases.

#### `cargo-deny`

##### Removed

-
[PR#681](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/681)
finished the deprecation introduced in
[PR#611](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/611),
making the usage of the deprecated fields into errors.

##### `[advisories]`

The following fields have all been removed in favor of denying all
advisories by default. To ignore an advisory the
[`ignore`](https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html#the-ignore-field-optional)
field can be used as before.

-   `vulnerability` - Vulnerability advisories are now `deny` by default
-   `unmaintained` - Unmaintained advisories are now `deny` by default
-   `unsound` - Unsound advisories are now `deny` by default
-   `notice` - Notice advisories are now `deny` by default
- `severity-threshold` - The severity of vulnerabilities is now
irrelevant

##### `[licenses]`

The following fields have all been removed in favor of denying all
licenses that are not explicitly allowed via either
[`allow`](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-allow-field-optional)
or
[`exceptions`](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-exceptions-field-optional).

- `unlicensed` - Crates whose license(s) cannot be confidently
determined are now always errors. The
[`clarify`](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-clarify-field-optional)
field can be used to help cargo-deny determine the license.
- `allow-osi-fsf-free` - The OSI/FSF Free attributes are now irrelevant,
only whether it is explicitly allowed.
- `copyleft` - The copyleft attribute is now irrelevant, only whether it
is explicitly allowed.
-   `default` - The default is now `deny`.
- `deny` - All licenses are now denied by default, this field added
nothing.

##### Changed

-
[PR#685](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/685)
follows up on
[PR#673](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/673),
moving the fields that were added to their own separate
[`bans.workspace-dependencies`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-workspace-dependencies-field-optional)
section. This is an unannounced breaking change but is fairly minor and
0.15.0 was never released on github actions so the amount of people
affected by this will be (hopefully) small. This also makes the
workspace duplicate detection off by default since the field is
optional, *but* makes it so that if not specified workspace duplicates
are now `deny` instead of `warn`.

##### Fixed

-
[PR#685](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/685)
resolved
[#&#8203;682](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/682)
by adding the `include-path-dependencies` field, allowing path
dependencies to be ignored if it is `false`.

###
[`v1.6.3`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.6.3):
Release 1.6.3 - cargo-deny 0.14.21

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.6.2...v1.6.3)

##### Fixed

-
[PR#643](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/643)
resolved
[#&#8203;629](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/629)
by making the hosted git (github, gitlab, bitbucket) org/user name
comparison case-insensitive. Thanks
[@&#8203;pmnlla](https://redirect.github.com/pmnlla)!
-
[PR#649](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/649)
fixed an issue where depending on the same crate multiple times by using
different `cfg()/triple` targets could cause features to be resolved
incorrectly and thus crates to be not pulled into the graph used for
checking.

#### \[0.14.20] - 2024-03-23

##### Fixed

-
[PR#642](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/642)
resolved
[#&#8203;641](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/641)
by pinning `gix-transport` (and its unique dependencies) to 0.41.2 as a
workaround for `cargo install` not using the lockfile. See [this
issue](https://redirect.github.com/Byron/gitoxide/issues/1328) for more
information.

###
[`v1.6.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.6.2):
Release 1.6.2 - cargo-deny 0.14.19

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.6.1...v1.6.2)

##### Changed

-
[PR#639](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/639)
updated tame-index to avoid an error if you don't used `--locked`.

#### \[0.14.18] - 2024-03-21

##### Fixed

-
[PR#638](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/638)
resolved
[#&#8203;636](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/636)
by updating `krates`.

#### \[0.14.17] - 2024-03-17

##### Changed

-
[PR#631](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/631)
improved the diagnostic for when the yank check fails due to some issue
with retrieving or reading the index information.
-
[PR#633](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/633)
updated `gix` -> 0.60.

###
[`v1.6.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.6.1)

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.6.0...v1.6.1)

##### Fixed

-
[PR#626](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/626)
resolved
[#&#8203;625](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/625)
by explicitly checking that a license identified as Pixar was actually
(probably) the Pixar license, instead of a normal Apache-2.0 license.

###
[`v1.6.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.6.0)

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.15...v1.6.0)

#### action changes

- Color output is now always enabled so that colors show up in the
action output.

#### 0.14.15

##### Added

-
[PR#618](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/618)
added metadata notes to diagnostics when a license is rejected, as well
as removing span information for accepted licenses unless the log level
is `info` or higher to make the diagnostic clearer by default.

#### 0.14.14

##### Fixed

-
[PR#617](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/617)
resolved
[#&#8203;576](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/576)
by updating the SPDX license list to 3.23.

#### 0.14.13

##### Fixed

-
[PR#615](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/615)
fixed an issue introduced in
[PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605)
where the various `bans` diagnostic codes could not have their lint
level changed via the CLI. It also introduced the `deprecated`
diagnostic code.

#### 0.14.12

##### Changed

-
[PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605)
did a major refactor of configuration, both how it is deserialized and
changing (hopefully improving) many options.
-
[PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605)
moved `targets`, `exclude`, `all-features`, `features`,
`no-default-features`, and `exclude` into the `[graph]` table.
-
[PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605)
moved `feature-depth` into the `[output]` table.

##### Added

-
[PR#613](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/613)
added support for [basic shell
expansion](https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html#the-db-path-field-optional)
to `advisories.db-path`, which expands support beyond just `~` to
include environment variable expansion.

##### Fixed

-
[PR#601](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/601)
resolved
[#&#8203;600](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/600)
by outputting the correct spans when a license was both allowed and
denied.
-
[PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605)
resolved
[#&#8203;264](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/264)
be replacing `toml` and `serde` with `toml-span`.
-
[PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605)
resolved
[#&#8203;539](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/539)
by simplifying the very common `name = "<crate_name>", version =
"<requirements>"` used to target specific crates into either a plain
[package spec
string](https://embarkstudios.github.io/cargo-deny/checks/cfg.html#string-format)
or the simpler `crate = "<package spec>"`.
-
[PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605)
resolved
[#&#8203;578](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/578)
by adding a `reason = "<reason>"` field to *many* fields within the
configuration that are provided in diagnostics. `[bans.deny]` also has
an additional `use-instead = "<url/crate_name>"`.
[PR#610](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/610)
did this for the `advisories.ignore` field.
-
[PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605)
resolved
[#&#8203;579](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/579)
by allowing yanked crates to be ignored by specifying a
[PackageSpec](https://embarkstudios.github.io/cargo-deny/checks/cfg.html#package-specs)
in the `[advisories.ignore]` array.

##### Deprecated

-
[PR#606](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/606)
and
[PR#611](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/611)
together deprecated several fields listed below. See
[PR#611](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/611)
for how to change your config to opt-in to the new behavior that will
become the default when the deprecated fields are removed in a future
minor version.
    -   `[advisories]`
        -   `vulnerability`
        -   `unmaintained`
        -   `unsound`
        -   `notice`
        -   `severity-threshold`
    -   `[licenses]`
        -   `unlicensed`
        -   `allow-osi-fsf-free`
        -   `copyleft`
        -   `default`
        -   `deny`

###
[`v1.5.15`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.15):
Release 1.5.15 - cargo-deny 0.14.11

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.14...v1.5.15)

##### Fixed

- Resolved
[https://github.com/EmbarkStudios/cargo-deny-action/issues/71](https://redirect.github.com/EmbarkStudios/cargo-deny-action/issues/71)
that was introduced in the previous release.

###
[`v1.5.14`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.14):
Release 1.5.14 - cargo-deny 0.14.11

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.13...v1.5.14)

##### Added

- Added the `manifest-path` key as a shorthand for doing `arguments:
--manifest-path <path>`

###
[`v1.5.13`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.13):
Release 1.5.13 - cargo-deny 0.14.11

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.12...v1.5.13)

##### Fixed

-
[PR#599](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/599)
resolved
[#&#8203;488](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/488)
by treating git and path sources differently. Thanks
[@&#8203;kpreid](https://redirect.github.com/kpreid)!

###
[`v1.5.12`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.12):
Release 1.5.12 - cargo-deny 0.14.10

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.11...v1.5.12)

##### Fixed

-
[PR#596](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/596)
updated `krates` *again* to pull in
[krates#77](https://redirect.github.com/EmbarkStudios/krates/pull/77).

###
[`v1.5.11`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.11):
Release 1.5.11 - cargo-deny 0.14.9

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.10...v1.5.11)

##### Fixed

-
[PR#594](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/594)
updated `krates` *again* to pull in
[krates#75](https://redirect.github.com/EmbarkStudios/krates/pull/75).

###
[`v1.5.10`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.10):
Release 1.5.10 - cargo-deny 0.14.8

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.9...v1.5.10)

##### Fixed

-
[PR#592](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/592)
updated `krates` *again* to pull in
[krates#73](https://redirect.github.com/EmbarkStudios/krates/pull/73).

###
[`v1.5.9`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.9):
Release 1.5.9 - cargo-deny 0.14.7

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.8...v1.5.9)

##### Fixed

-
[PR#591](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/591)
updated `krates` *again* to pull in
[krates#71](https://redirect.github.com/EmbarkStudios/krates/pull/71).

###
[`v1.5.8`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.8):
Release 1.5.8 - cargo-deny 0.14.6

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.7...v1.5.8)

##### Fixed

-
[PR#590](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/590)
updated `krates` to fix an issue with crates that directly have a
dependency on 2 or more versions of the same crate.

##### Added

-
[PR#590](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/590)
resolved
[#&#8203;405](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/405)
by emitting warnings when a `wrapper` crate for a banned crate does not
have a dependency on that crate.

##### Changed

-
[PR#591](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/591)
updated `gix` and `tame-index`.

###
[`v1.5.7`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.7):
Release 1.5.7 - cargo-deny 0.14.5

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.6...v1.5.7)

##### Fixed

-
[PR#588](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/588)
resolved an issue introduced in \[0.14.4] where features that reference
dev-only dependencies in non-workspace crates would cause a
[panic](https://redirect.github.com/EmbarkStudios/krates/issues/66).

###
[`v1.5.6`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.6):
Release 1.5.6 - cargo-deny 0.14.4

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.5...v1.5.6)

##### Fixed

-
[PR#586](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/586)
resolved 2 issues with crate graph creation, see
[krates#60](https://redirect.github.com/EmbarkStudios/krates/issues/60)
and
[krates#64](https://redirect.github.com/EmbarkStudios/krates/issues/64)
for more details.

###
[`v1.5.5`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.5):
Release 1.5.5 - cargo-deny 0.14.2

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.4...v1.5.5)

##### Added

-
[PR#545](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/545)
added the ability to specify additional license exceptions via
[additional configuration
files](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#additional-exceptions-configuration-file).
-
[PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549)
added the
[`bans.build`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-build-field-optional)
configuration option, opting in to checking for [file
extensions](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-script-extensions-field-optional),
[native
executables](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-executables-field-optional),
and [interpreted
scripts](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-interpreted-field-optional).
This resolved
[#&#8203;43](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/43).

##### Changed

-
[PR#557](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/557)
introduced changes to how
[`dev-dependencies`](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#development-dependencies)
are handled. By default, crates that are only used as dev-dependencies
(ie, there are no normal nor build dependency edges linking them to
other crates) will no longer be considered when checking for
[`multiple-versions`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-multiple-versions-field-optional)
violations. This can be re-enabled via the
[`bans.multiple-versions-include-dev`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-multiple-versions-include-dev-field-optional)
config field. Additionally, licenses are no longer checked for
`dev-dependencies`, but can be re-enabled via
[`licenses.include-dev`](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-include-dev-field-optional)
the config field. `dev-dependencies` can also be completely disabled
altogether, but this applies to all checks, including `advisories` and
`sources`, so is not enabled by default. This behavior can be enabled by
using the
[`exclude-dev`](https://embarkstudios.github.io/cargo-deny/checks/cfg.html#the-exclude-dev-field-optional)
field, or the `--exclude-dev` command line flag. This change resolved
[#&#8203;322](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/322),
[#&#8203;329](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/329),
[#&#8203;413](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/413)
and
[#&#8203;497](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/497).

##### Fixed

-
[PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549)
fixed
[#&#8203;548](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/548)
by correctly locating cargo registry indices from an git ssh url.
-
[PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549)
fixed
[#&#8203;552](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/552)
by correctly handling signal interrupts and removing the advisory-dbs
lock file.
-
[PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549)
fixed
[#&#8203;553](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/553)
by adding the `native-certs` feature flag that can enable the OS native
certificate store.

##### Deprecated

-
[PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549)
moved `bans.allow-build-scripts` to
[`bans.build.allow-build-scripts`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-allow-build-scripts-field-optional).
`bans.allow-build-scripts` is still supported, but emits a warning.

###
[`v1.5.4`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.4):
Release 1.5.4 - cargo-deny 0.14.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.3...v1.5.4)

Updated the cargo version to 1.71.0 which should give significant
improvements to run times due to using the crates.io sparse index
instead of the old git index.

###
[`v1.5.3`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.3):
Release 1.5.3 - cargo-deny 0.14.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.2...v1.5.3)

##### Changed

- [PR#520] resolved
[#&#8203;522](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/522)
by completely removing all dependencies upon `git2` and `openssl`. This
was done by transitioning from `git2` -> `gix` for all git operations,
both directly in this crate, as well as replacing
[`crates-index`](https://redirect.github.com/frewsxcv/rust-crates-index)
with
[`tame-index`](https://redirect.github.com/EmbarkStudios/tame-index).
-   [PR#520] bumped the MSRV from `1.65.0` -> `1.70.0`
-
[PR#523](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/523)
added "(try `cargo update -p <crate_name>`)" when an advisory is
detected for a crate. Thanks
[@&#8203;Victor-N-Suadicani](https://redirect.github.com/Victor-N-Suadicani)!

##### Fixed

- [PR#520] resolved
[#&#8203;361](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/361)
by printing output when a fetch is being performed to clarify what is
taking time.
- [PR#520] (possibly) resolved
[#&#8203;435](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/435)
by switching all git operations from `git2` to `gix`.
- [PR#520] resolved
[#&#8203;439](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/439)
by using minimal refspecs for cloning and fetching all remote git
repositories (indices or advisory databases) where only the remote HEAD
is needed to update the local repository, regardless of the default
remote branch pointed to by HEAD.
- [PR#520] resolved
[#&#8203;446](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/446)
by ensuring (and testing) that crates from non-registry sources are not
checked for advisories, eg. in the case that a local crate is named and
versioned the same as a crate from crates.io that has an advisory that
affects it.
- [PR#520] resolved
[#&#8203;515](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/515)
by always opening the correct registry index based upon the environment.
-
[PR#531](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/531)
resolved
[#&#8203;210](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/210)
by adding `osi` and `fsf` options to `licenses.allow-osi-fsf-free`.
Thanks [@&#8203;zkxs](https://redirect.github.com/zkxs)!
-
[PR#533](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/533)
resolved
[#&#8203;521](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/521)
and
[#&#8203;524](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/524)
by allowing clarifications to add files that are used to verify the
license information is up to date, rather than needing to match one of
the license files that was discovered.
-
[PR#534](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/534)
resolved
[#&#8203;479](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/479)
by improving how advisory databases are cloned and/or fetched, notably
each database now uses `gix`'s [file-based
locking](https://docs.rs/gix-lock/7.0.2/gix_lock/struct.Marker.html#method.acquire_to_hold_resource)
to ensure that only one process has mutable access to an advisory
database repo at a time.

##### Removed

- [PR#520] removed all features, notably `standalone`. This is due to
cargo still being in transition from `git2` -> `gix` and having no way
to compiled *without* OpenSSL. Once cargo is a better state with regards
to this we can add back that feature.

[PR#520]: https://redirect.github.com/EmbarkStudios/cargo-deny/pull/520

###
[`v1.5.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.2):
Release 1.5.2 - cargo-deny 0.13.9

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.1...v1.5.2)

##### Fixed

-
[PR#506](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/506)
replaced `atty` (unmaintained) with `is-terminal`. Thanks
[@&#8203;tottoto](https://redirect.github.com/tottoto)!
-
[PR#511](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/511)
resolved
[#&#8203;494](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/494),
[#&#8203;507](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/507),
and
[#&#8203;510](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/510)
by fixing up how and when urls are normalized.
-
[PR#512](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/512)
resolved
[#&#8203;509](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/509)
by fixing casing of the root configuration keys.
-
[PR#513](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/513)
resolved
[#&#8203;508](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/508)
by correctly using the crates.io sparse index when checking for yanked
crates if specified by the user, as well as falling back to the regular
git index if the sparse index is not present.

###
[`v1.5.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.1):
Release 1.5.1 - cargo-deny 0.13.8

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.0...v1.5.1)

##### Added

-
[PR#504](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/504)
(though really
[PR#365](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/365))
resolved
[#&#8203;350](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/350)
by adding the `deny-multiple-versions` field to `bans.deny` entries,
allowing specific crates to deny multiple versions while
allowing/warning on them more generally. Thanks
[@&#8203;leops](https://redirect.github.com/leops)!
-
[PR#493](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/493)
resolved
[#&#8203;437](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/437)
by also looking for deny configuration files in `.cargo`. Thanks
[@&#8203;DJMcNab](https://redirect.github.com/DJMcNab)!
-
[PR#502](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/502)
resolved
[#&#8203;500](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/500)
by adding initial support for [sparse
indices](https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-sparse-protocol.html).

##### Fixed

-
[PR#503](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/503)
resolved
[#&#8203;498](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/498)
by falling back to more lax parsing of the SPDX expression of crate if
fails to parse according to the stricter but more correct rules.

###
[`v1.5.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.0):
Release 1.5.0 - cargo-deny 0.13.7

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.4.0...v1.5.0)

Update from cargo-deny 0.13.5 to 0.13.7, apparently I missed two
releases, that's embarrassing.

#### 0.13.7

##### Fixed

-
[PR#491](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/491)
resolved
[#&#8203;490](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/490)
by building libgit2 from vendored sources instead of relying on
potentially outdated packages.

#### 0.13.6

##### Changed

-
[PR#489](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/489)
updated dependencies, notably `clap`, `cargo`, and `git2`

##### Added

-
[PR#485](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/485)
added this project and repository to our Security Bug Bounty Program and
has Private vulnerability reporting enabled. See
[`SECURITY.md`](./SECURITY.md) for more details.
-
[PR#487](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/487)
added `allow-wildcard-paths`, fixing
[#&#8203;488](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/448)
by allowing wildcards to be denied, but allowing them for internal,
private crates. Thanks [@&#8203;sribich](https://giqthub.com/sribich)!

##### Fixed

-
[PR#489](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/489)
fixed an issue where git sources where `branch=master` would be
incorrectly categorized as not specifying the branch (ie use HEAD of
default branch).

###
[`v1.4.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.4.0):
Release 1.4.0 - cargo-deny 0.13.5

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.3.2...v1.4.0)

##### Changed

-   Updated to cargo-deny 0.13.5

###
[`v1.3.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.3.2):
- cargo-deny 0.12.1

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.3.1...v1.3.2)

##### Added

- [PR#54](https://redirect.github.com/PR/cargo-deny-action/issues/54)
resolved
[#&#8203;53](https://redirect.github.com/EmbarkStudios/cargo-deny-action/issues/53)
by adding the `credentials` parameter for passing in a private access
token to allow cargo to fetch private github repositories. Thanks
[@&#8203;danielhaap83](https://redirect.github.com/danielhaap83)!

###
[`v1.3.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.3.1):
- cargo-deny 0.12.1

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.3.0...v1.3.1)

##### Fixed

-
[PR#426](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/426)
fixed an oversight in
[PR#422](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/422),
fully resolving
[#&#8203;412](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/412)
by allowing both `https` and `ssh` URLs for advisory databases. Thanks
[@&#8203;jbg](https://redirect.github.com/jbg)!

##### Changed

-
[PR#427](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/427)
updated dependencies.

###
[`v1.3.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.3.0):
- cargo-deny 0.12.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.17...v1.3.0)

##### Removed

-
[PR#423](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/423)
removed the `fix` subcommand. This functionality was far too complicated
for far too little benefit.

##### Fixed

-
[PR#420](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/420)
resolved
[#&#8203;388](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/388)
by adding the ability to fetch advisory databases via the `git` CLI.
Thanks [@&#8203;danielhaap83](https://redirect.github.com/danielhaap83)!
-
[PR#422](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/422)
fixed
[#&#8203;380](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/380)
and
[#&#8203;410](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/410)
by updating a few transitive dependencies that use `git2`, as well as
removing the usage of `rustsec`'s `git` feature so that we now use `git2
v0.14`, resolving a crash issue in new `libgit2` versions available in
eg. rolling release distros such as Arch. This should also make it
easier to update and improve git related functionality since more of it
is inside cargo-deny itself now.
-
[PR#424](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/424)
*really* fixed (there's even a test now!)
[#&#8203;384](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/384)
by adding each version's reverse dependency graph in the ascending
order.

###
[`v1.2.17`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.17):
- cargo-deny 0.11.4

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.16...v1.2.17)

#### Changed

-
[PR#51](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/51)
updated the image to use Rust 1.60.0 by default. Thanks
[@&#8203;MarcoIeni](https://redirect.github.com/MarcoIeni)!

###
[`v1.2.16`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.16):
- cargo-deny 0.11.4

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.15...v1.2.16)

#### Added

-
[PR#49](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/49)
added the `command-arguments` option to the action. Thanks
[@&#8203;ryo33](https://redirect.github.com/ryo33)!

###
[`v1.2.15`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.15):
- cargo-deny 0.11.3

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.14...v1.2.15)

##### Fixed

- Accidentally change how arguments were forwarded to cargo-deny which
broken more complicated invocations

###
[`v1.2.14`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.14):
- cargo-deny 0.11.3

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.13...v1.2.14)

##### Added

- Added `git` to the image, resolving
[#&#8203;40](https://redirect.github.com/EmbarkStudios/cargo-deny-action/issues/40)

###
[`v1.2.13`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.13):
- cargo-deny 0.11.3

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.12...v1.2.13)

##### Changed

- Added the `rust-version` github actions variable, allowing you to
specify a specific cargo version to use when running cargo-deny,
including nightly, or other unstable versions.

###
[`v1.2.12`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.12):
- cargo-deny 0.11.3

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.11...v1.2.12)

##### Fixed

-
[PR#407](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/407)
resolved
[#&#8203;406](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/406)
by always checking license exceptions first.

###
[`v1.2.11`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.10...v1.2.11)

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.10...v1.2.11)

###
[`v1.2.10`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.10):
- cargo-deny 0.11.1

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.9...v1.2.10)

##### Added

-
[PR#391](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/391)
resolved
[#&#8203;344](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/344)
by adding `[licenses.ignore-sources]` to ignore license checking for
crates sourced from 1 or more specified registries. Thanks
[@&#8203;ShellWowza](https://redirect.github.com/ShellWowza)!
-
[PR#396](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/396)
resolved
[#&#8203;366](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/366)
by also looking for `.deny.toml` in addition to `deny.toml` if a config
file is not specified.

##### Changed

-
[PR#392](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/392)
updated all dependencies.

##### Fixed

-
[PR#393](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/393)
resolved
[#&#8203;371](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/371)
by changing the default for version requirements specified in config
files to accept all versions, rather than using the almost-but-not-quite
default of `*`.
-
[PR#394](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/394)
resolved
[#&#8203;147](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/147)
by ignore *all* private crates, not only the ones in the workspace.
-
[PR#395](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/395)
resolved
[#&#8203;375](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/375)
by fixing a potential infinite loop when using `[bans.skip-tree]`.

###
[`v1.2.9`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.9):
- cargo-deny 0.11.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.8...v1.2.9)

Fixed image to use proper tag.

###
[`v1.2.8`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.8):
- cargo-deny 0.11.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.7...v1.2.8)

Updated the cargo version in the image to 1.57.0 to allow for the use of
[custom
profiles](https://doc.rust-lang.org/cargo/reference/profiles.html#custom-profiles).

###
[`v1.2.7`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.7):
v1.2.6 - cargo-deny 0.11.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.6...v1.2.7)

#### \[0.11.0] - 2021-12-06

##### Changed

-
[PR#382](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/382)
updated dependencies and bumped the Minimum Stable Rust Version to
**1.56.1**.

#### \[0.10.3] - 2021-11-22

##### Changed

-
[PR#379](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/379)
updated `askalono` which got rid of the `failure` dependency, which was
pulling in a lot of additional crates that are now gone.

##### Fixed

-
[PR#379](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/379)
fixed
[#&#8203;378](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/378)
which was an edge case where the `sources` check was executed against a
crate that didn't use any crates from crates.io, and the config file was
shorter than the crates.io URL.

#### \[0.10.2] - 2021-11-21

##### Fixed

-
[PR#376](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/376)
fixed the JSON formatting when using `--format json` output option.
Thanks [@&#8203;dnaka91](https://redirect.github.com/dnaka91)!

##### Changed

-
[PR#377](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/377)
updated dependencies.

#### \[0.10.1] - 2021-11-10

##### Fixed

-
[PR#347](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/374)
resolved
[#&#8203;372](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/372)
by correcting a slight mistake that resulted in an incorrect hash making
cargo-deny unable to lookup index or crate information from the local
file system.

#### \[0.10.0] - 2021-10-29

##### Added

-
[PR#353](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/353)
resolved
[#&#8203;351](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/351)
by adding the `sources.private` field to blanket allow git repositories
sourced from a particular url.
-
[PR#359](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/359)
resolved
[#&#8203;341](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/341)
and
[#&#8203;357](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/357)
by adding support for the [`--frozen`, `--locked`, and
`--offline`](https://doc.rust-lang.org/cargo/commands/cargo-metadata.html#manifest-options)
flags to determine whether network access is allowed, and whether the
`Cargo.lock` file can be created and/or modified.
-
[PR#368](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/368)
added the `licenses.unused-allowed-license` field to control whether the
[L006 - license was not
encountered](https://embarkstudios.github.io/cargo-deny/checks/licenses/diags.html#l006---license-was-not-encountered)
diagnostic. Thanks [@&#8203;thomcc](https://redirect.github.com/thomcc)!

##### Changed

-
[PR#358](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/358)
bumped the Minimum Stable Rust Version to **1.53.0**.
-
[PR#358](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/358)
bumped various dependencies, notably `semver` to `1.0.3`.

#### \[0.9.1] - 2021-03-26

##### Changed

-   Updated dependencies

###
[`v1.2.6`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.6):
Release 1.2.6 - cargo-deny 0.9.1

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.5...v1.2.6)

##### Changed

-   Updated dependencies

###
[`v1.2.5`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.5):
- cargo-deny 0.9.0

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.4...v1.2.5)

##### Changed

- Updated `krates`, which in turn uses an updated `cargo_metadata` which
uses [`camino`](https://docs.rs/camino) for utf-8 paths. Rather than
support both vanilla Path/Buf and Utf8Path/Buf, cargo-deny now just uses
Utf8Path/Buf, which means that non-utf-8 paths for things like your
Cargo.toml manifest or license paths will no longer function. This is a
breaking change, that can be reverted if it disruptive for users, but
the assumption is that cargo-deny is operating on normal checkouts of
rust repositories that are overwhelmingly going to be utf-8 compatible
paths.

###
[`v1.2.4`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.4):
Update image

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.3...v1.2.4)

Updates the base image to rust 1.50.0 to fix issue if you pin to it via
eg rust-toolchain.

###
[`v1.2.3`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.3):
- cargo-deny 0.8.5

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.2...v1.2.3)

##### Added

-
[PR#315](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/315)
resolved
[#&#8203;312](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/312)
by adding support for excluding packages in the deny configuration file,
in addition to the existing support for the `--exclude` CLI option.
Thanks [@&#8203;luser](https://redirect.github.com/luser)!

##### Fixed

-
[PR#318](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/318)
fixed
[#&#8203;316](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/316)
by adding a workaround for crate versions with pre-release identifiers
in them that could be erroneously marked as matching advisories in an
advisory database. Thanks for reporting this
[@&#8203;djc](https://redirect.github.com/djc)!

###
[`v1.2.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.2):
- cargo-deny 0.8.4

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.1...v1.2.2)

##### Changed

-   Updated dependencies, notably `rustsec`, `crossbeam`\*, and `cargo`.
-   Bumped the Minimum Stable Rust Version to **1.44.1**.

###
[`v1.2.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.1):
- cargo-deny 0.8.1

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/1.2.0...v1.2.1)

Updates cargo-deny from 0.7.3 -> 0.8.1

##### Added

-
[PR#238](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/238)
resolved
[#&#8203;225](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/225)
by adding a `wrappers` field to `[bans.deny]` entries, which allows the
banned crate to be used only if it is a direct dependency of one of the
wrapper crates. Thanks
[@&#8203;Stupremee](https://redirect.github.com/Stupremee)!
-
[PR#244](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/244)
resolved
[#&#8203;69](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/69)
by adding support for multiple advisory databases, which will all be
checked during the `advisory` check. Thanks
[@&#8203;Stupremee](https://redirect.github.com/Stupremee)!
-
[PR#243](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/243)
resolved
[#&#8203;54](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/54)
by adding support for compiling and using `cargo` crate directly via the
`standalone` feature. This allows `cargo-deny` to be used without cargo
being installed, but it still requires
[**rustc**](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/295)
to be available. Thanks
[@&#8203;Stupremee](https://redirect.github.com/Stupremee)!
-
[PR#275](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/275)
resolved
[#&#8203;64](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/64)
by adding a diagnostic when a user tries to ignore an advisory
identifier that doesn't exist in any database.
-
[PR#262](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/262)
added the `fix` subcommand, which was added to bring `cargo-deny` to
feature parity with `cargo-audit` so that it can take over for
`cargo-audit` as the [official
frontend](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/194)
for the the [RustSec Advisory
Database](https://redirect.github.com/RustSec/advisory-db).

##### Changed

- `advisories.db-url` has been deprecated in favor of
`advisories.db-urls` since multiple databses are now supported.
- `advisories.db-path` is now no longer the directory into which the
advisory database is cloned into, but rather a root directory where each
unique database is placed in a canonicalized directory similar to how
`.cargo/registry/index` directories work.
-
[PR#274](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/274)
resolved
[#&#8203;115](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/115)
by normalizing git urls. Thanks
[@&#8203;senden9](https://redirect.github.com/senden9)!

##### Fixed

-
[#&#8203;265](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/265)
A transitive dependency (`smol_str`) forced the usage of the latest Rust
stable version (1.46) which was unintended. We now state the MSRV in the
README and check for it in CI so that changing the MSRV is a conscious
decision.
-
[PR#287](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/287)
fixed
[#&#8203;286](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/286),
which could happen if using a git source where the representation
differed slightly between the user specified id and the id used for
dependencies.
-
[PR#249](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/249)
fixed
[#&#8203;190](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/190)
by printing a different diagnostic for when the path specified for a
clarification license file could not be found. Thanks
[@&#8203;khodzha](https://redirect.github.com/khodzha)!
-
[PR#297](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/297)
fixed a couple of diagnostics to have codes.
-
[PR#296](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/296)
resolved
[#&#8203;288](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/288)
by improving the information in diagnostics pertaining to advisories.
Thanks [@&#8203;tomasfarias](https://redirect.github.com/tomasfarias)!

###
[`v1.2.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/1.2.0):
- cargo-deny 0.8.1

[Compare
Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.1.0...1.2.0)

Updates cargo-deny from 0.7.3 -> 0.8.1

##### Added

-
[PR#238](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/238)
resolved
[#&#8203;225](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/225)
by adding a `wrappers` field to `[bans.deny]` entries, which allows the
banned crate to be used only if it is a direct dependency of one of the
wrapper crates. Thanks
[@&#8203;Stupremee](https://redirect.github.com/Stupremee)!
-
[PR#244](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/244)
resolved
[#&#8203;69](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/69)
by adding support for multiple advisory databases, which will all be
checked during the `advisory` check. Thanks
[@&#8203;Stupremee](https://redirect.github.com/Stupremee)!
-
[PR#243](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/243)
resolved
[#&#8203;54](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/54)
by adding support for compiling and using `cargo` crate directly via the
`standalone` feature. This allows `cargo-deny` to be used without cargo
being installed, but it still requires
[**rustc**](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/295)
to be available. Thanks
[@&#8203;Stupremee](https://redirect.github.com/Stupremee)!
-
[PR#275](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/275)
resolved
[#&#8203;64](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/64)
by adding a diagnostic when a user tries to ignore an advisory
identifier that doesn't exist in any database.
-
[PR#262](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/262)
added the `fix` subcommand, which was added to bring `cargo-deny` to
feature parity with `cargo-audit` so that it can take over for
`cargo-audit` as the [official
frontend](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/194)
for the the [RustSec Advisory
Database](https://redirect.github.com/RustSec/advisory-db).

##### Changed

- `advisories.db-url` has been deprecated in favor of
`advisories.db-urls` since multiple databses are now supported.
- `advisories.db-path` is now no longer the directory into which the
advisory database is cloned into, but rather a root directory where each
unique database is placed in a canonicalized directory similar to how
`.cargo/registry/index` directories work.
-
[PR#274](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/274)
resolved
[#&#8203;115](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/115)
by normalizing git urls. Thanks
[@&#8203;senden9](https://redirect.github.com/senden9)!

##### Fixe

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-04-28 10:56:57 +02:00
renovate[bot]
aacf2a724c
Update astral-sh/setup-uv action to v6 (#13162)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
action | major | `v5.4.2` -> `v6.0.0` |

---

### Release Notes

<details>
<summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary>

###
[`v6.0.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v6.0.0):
🌈 activate-environment and working-directory

[Compare
Source](https://redirect.github.com/astral-sh/setup-uv/compare/v5.4.2...v6.0.0)

##### Changes

This version contains some breaking changes which have been gathering up
for a while. Lets dive into them:

-   [Activate environment](#activate-environment)
-   [Working Directory](#working-directory)
-   [Default `cache-dependency-glob`](#default-cache-dependency-glob)
- [Use default cache dir on self hosted
runners](#use-default-cache-dir-on-self-hosted-runners)

##### Activate environment

In previous versions using the input `python-version` automatically
activated a venv at the repository root.
This led to some unwanted side-effects, was sometimes unexpected and not
flexible enough.

The venv activation is now explicitly controlled with the new input
`activate-environment` (false by default):

```yaml
- name: Install the latest version of uv and activate the environment
  uses: astral-sh/setup-uv@v6
  with:
    activate-environment: true
- run: uv pip install pip
```

The venv gets created by the [`uv
venv`](https://docs.astral.sh/uv/pip/environments/) command so the
python version is controlled by the `python-version` input or the files
`pyproject.toml`, `uv.toml`, `.python-version` in the
`working-directory`.

##### Working Directory

The new input `working-directory` controls where we look for
`pyproject.toml`, `uv.toml` and `.python-version` files
which are used to determine the version of uv and python to install.

It can also be used to control where the venv gets created.

```yaml
- name: Install uv based on the config files in the working-directory
  uses: astral-sh/setup-uv@v6
  with:
    working-directory: my/subproject/dir
```

> \[!CAUTION]
>
> The inputs `pyproject-file` and `uv-file` have been removed.

##### Default `cache-dependency-glob`

[@&#8203;ssbarnea](https://redirect.github.com/ssbarnea) found out that
the default `cache-dependency-glob` was not suitable for a lot of users.

The old default

```yaml
cache-dependency-glob: |
  **/requirements*.txt
  **/uv.lock
```

is changed and should cover over 99.5% of use cases:

```yaml
cache-dependency-glob: |
  **/*(requirements|constraints)*.(txt|in)
  **/pyproject.toml
  **/uv.lock
```

> \[!NOTE]
>
> This shouldn't be a breaking change. The only thing you may notice is
that your caches get invalidated once.

##### Use default cache dir on self hosted runners

The directory where uv stores its cache was always set to a directory in
`RUNNER_TEMP`. For self-hosted runners this made no sense as this gets
cleaned after every run and led to slower runs than necessary.

On self-hosted runners `UV_CACHE_DIR` is no longer set and the [default
cache
directory](https://docs.astral.sh/uv/concepts/cache/#cache-directory) is
used instead.

##### 🚨 Breaking changes

- Change default cache-dependency-glob
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;352](https://redirect.github.com/astral-sh/setup-uv/issues/352))
- No default UV_CACHE_DIR on selfhosted runners
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;380](https://redirect.github.com/astral-sh/setup-uv/issues/380))
- new inputs activate-environment and working-directory
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;381](https://redirect.github.com/astral-sh/setup-uv/issues/381))

##### 🧰 Maintenance

- chore: update known checksums for 0.6.16
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;378](https://redirect.github.com/astral-sh/setup-uv/issues/378))
- chore: update known checksums for 0.6.15
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;377](https://redirect.github.com/astral-sh/setup-uv/issues/377))

##### 📚 Documentation

- bump to v6 in README
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;382](https://redirect.github.com/astral-sh/setup-uv/issues/382))
- log info on venv activation
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;375](https://redirect.github.com/astral-sh/setup-uv/issues/375))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-04-28 10:53:35 +02:00
John Mumm
4ee4a8861e
Implement RFC 7231 compliant relative URI and fragment handling in redirects (#13050)
This PR restores #13041 and integrates two PRs from @zanieb:
* #13038
* #13040

It also adds tests for relative URI and fragment handling.

Closes #13037.

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-04-28 09:07:06 +02:00
renovate[bot]
576a4ae3a7
Update Rust crate tempfile to v3.19.1 (#13158)
Some checks are pending
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on ubuntu (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | python on macos aarch64 (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python on macos x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
2025-04-28 03:08:02 +00:00
renovate[bot]
0f58828003
Update Swatinem/rust-cache action to v2.7.8 (#13160) 2025-04-27 22:30:40 -04:00
renovate[bot]
602d29a622
Update Rust crate miette to v7.6.0 (#13154) 2025-04-28 02:30:22 +00:00
renovate[bot]
2284985381
Update Rust crate indexmap to v2.9.0 (#13152) 2025-04-28 02:26:36 +00:00
renovate[bot]
9c8f13d102
Update Rust crate insta to v1.43.0 (#13153) 2025-04-28 02:26:15 +00:00
renovate[bot]
7aa2b82673
Update Rust crate smallvec to v1.15.0 (#13157) 2025-04-27 22:25:57 -04:00
renovate[bot]
8727b01c37
Update Rust crate petgraph to 0.8.0 (#13156) 2025-04-27 22:25:47 -04:00
renovate[bot]
7770ac60db
Update Rust crate once_cell to v1.21.3 (#13155) 2025-04-27 22:25:39 -04:00
renovate[bot]
0a49849f5a
Update docker/build-push-action action to v6.16.0 (#13151) 2025-04-28 02:23:30 +00:00
renovate[bot]
5783ed666e
Update actions/setup-python action to v5.6.0 (#13150) 2025-04-27 21:38:50 -04:00
renovate[bot]
edbc6e9235
Update Rust crate toml to v0.8.21 (#13148) 2025-04-27 21:29:39 -04:00
ndrew222
6171f0aea8
[docs] Changed fish completions append >> to overwrite > (#13130) 2025-04-27 20:52:14 -04:00
renovate[bot]
2c5e95c6bc
Update Rust crate tokio-util to v0.7.15 (#13147) 2025-04-27 20:37:38 -04:00
renovate[bot]
17cfd82c34
Update taiki-e/install-action digest to ab3728c (#13143) 2025-04-28 00:32:30 +00:00
renovate[bot]
bb16905a69
Update pypa/gh-action-pypi-publish digest to db8f07d (#13142) 2025-04-27 20:31:18 -04:00
renovate[bot]
eb7590393f
Update Rust crate syn to v2.0.101 (#13146) 2025-04-27 20:30:52 -04:00
renovate[bot]
5f6c5237b4
Update Rust crate jiff to v0.2.10 (#13145) 2025-04-27 20:28:55 -04:00
renovate[bot]
42211df3d0
Update pre-commit hook astral-sh/ruff-pre-commit to v0.11.7 (#13144) 2025-04-27 20:27:47 -04:00
Charlie Marsh
38bcf66861
Don't run CodSpeed benchmarks outside of astral-sh/uv (#13140)
## Summary

This fails on forks, I think, since you can't post to CodSpeed.
2025-04-27 20:22:31 -04:00
Charlie Marsh
dc5b3762f3
Show tag hints when failing to find a compatible wheel in pylock.toml (#13136)
Some checks are pending
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on ubuntu (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | python on macos aarch64 (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python on macos x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
## Summary

Closes #13135.
2025-04-27 12:56:50 -04:00
Charlie Marsh
78756de027
Respect build options (--no-binary et al) in pylock.toml (#13134)
## Summary

Closes #13133.
2025-04-27 12:28:30 -04:00
Charlie Marsh
17b4ebed8e
Avoid erroring on omitted wheel-only packages in pylock.toml (#13132)
## Summary

Closes https://github.com/astral-sh/uv/issues/13127.
2025-04-27 11:58:20 -04:00
Charlie Marsh
1cafcd0ad9
Loosen github.repository match in ci.yml (#13121)
Some checks are pending
CI / check system | python on macos aarch64 (push) Blocked by required conditions
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on ubuntu (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python on macos x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
## Summary

Discussed with @zanieb and was recommended to remove this piece
entirely.
2025-04-26 16:16:58 +00:00
ReinforcedKnowledge
1b23035703
Add pylock.toml mentions where relevant (#13115)
Just a small PR to add mentions to `pylock.toml` in the CLI manual where
appropriate.

I tried to say "PEP-751 compatible lock files" when appropriate to also
include the case `r"^pylock\.([^.]+)\.toml$"`. Feel free to change that
if you think it's cluttery.

I also tried to include the "single-use" wording when it made sense.

I also have almost never used the `uv pip` interface, so maybe there are
some other minor things to add here and there about the usage of
`pylock.toml` that I missed.

---------

Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
2025-04-26 14:26:30 +00:00
Zanie Blue
fb08116800
Report Python versions in pyvenv.cfg version mismatch (#13027)
Some checks are pending
CI / integration test | uv_build (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on ubuntu (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python on macos x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
When working on #13025 I noticed this message was lacking versions,
which seems frustrating if you're debugging things.

I refactored the general `matches_interpreter` utilities that were added
in https://github.com/astral-sh/uv/pull/12884 into a more purpose-fit
function that returns an `Option` with the versions if there's a
mismatch.
2025-04-25 18:06:46 +00:00
Charlie Marsh
8414e9f3dd
Bump version to v0.6.17 (#13110) 2025-04-25 12:57:07 -05:00
konsti
c7c9b7a90e
Test publishing with pypa/gh-action-pypi-publish (#12742)
A publish testing for #11652
2025-04-25 18:27:40 +02:00
konsti
09129031a4
Fix panic with invalid last char in PEP 508 name (#13105)
Fixes #13102
2025-04-25 14:56:46 +02:00
konsti
ae5c77c0e4
Reject requires python even if not listed on the index page (#13086)
Some checks are pending
CI / integration test | uv_build (push) Blocked by required conditions
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on ubuntu (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | python on macos aarch64 (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
Reject distributions with an incompatible `Requires-Python`, even if the
index page is missing `data-requires-python`.

Fixes #13079
2025-04-25 12:52:02 +02:00
konsti
cd7621043e
Block scripts from overwriting python (#13051)
uv adds some binaries and scripts to a venv, and installed packages
should not be allowed to overwrite them.

Fixes #12983
2025-04-25 07:10:10 +00:00
John Mumm
9fb19cd43c
Check for mismatched package and distribution names on resolver thread (#13088)
Some checks are pending
CI / integration test | uv_build (push) Blocked by required conditions
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on ubuntu (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | python on macos aarch64 (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
This PR restores the `bogus_redirect` test that was
non-deterministically hanging (reverting #13076).

Mismatched package and distribution names were causing uv to hang prior
to #12917 (which added the `bogus_redirect` test). But with that fix, uv
was only checking for mismatched package names on the main thread (and
not the resolver thread). This allowed for a race condition which would
prevent uv from ever doing the check, triggering the original hang
condition. This PR adds the check to the resolver thread to prevent this
race condition.
2025-04-24 15:18:01 +02:00
konsti
43e5a6ef96
Update pubgrub to a3b4db3 (#13066)
Some checks are pending
CI / integration test | uv_build (push) Blocked by required conditions
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | python on macos aarch64 (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python on macos x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
Maintenance update to PubGrub a3b4db3abb1829ce889fb89fa6d157fef529ef7e
2025-04-24 10:39:57 +00:00
Charlie Marsh
a4ea814159
Avoid panic for invalid Python versions (#13077)
Some checks are pending
CI / integration test | uv_build (push) Blocked by required conditions
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | python on ubuntu (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | python on macos aarch64 (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python on macos x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
## Summary

We unwrap these further on, so we should validate them ahead of time.

Closes https://github.com/astral-sh/uv/issues/13075.
2025-04-23 22:23:33 +00:00
Charlie Marsh
a6a0087f74
Temporarily remove bogus redirect test (#13076)
## Summary

This needs to be made more reliable.
2025-04-23 17:18:31 -04:00
Charlie Marsh
4bef9fadbb
Add PyTorch v2.7.0 to GPU backend (#13072)
## Summary

The first version to support CUDA 12.8.
2025-04-23 16:59:41 -04:00
konsti
473d7c75a4
Check dist name to handle bogus redirect (#12917)
Some checks failed
CI / integration test | uv_build (push) Has been cancelled
CI / check system | homebrew python on macos aarch64 (push) Has been cancelled
CI / check cache | ubuntu (push) Has been cancelled
CI / check cache | macos aarch64 (push) Has been cancelled
CI / check system | python on debian (push) Has been cancelled
CI / check system | python on fedora (push) Has been cancelled
CI / check system | python on ubuntu (push) Has been cancelled
CI / check system | python3.12 via chocolatey (push) Has been cancelled
CI / check system | python on opensuse (push) Has been cancelled
CI / check system | python on rocky linux 8 (push) Has been cancelled
CI / check system | python on rocky linux 9 (push) Has been cancelled
CI / check system | pypy on ubuntu (push) Has been cancelled
CI / check system | pyston (push) Has been cancelled
CI / check system | python on macos x86-64 (push) Has been cancelled
CI / check system | python3.10 on windows x86-64 (push) Has been cancelled
CI / check system | python3.10 on windows x86 (push) Has been cancelled
CI / check system | python3.13 on windows x86-64 (push) Has been cancelled
CI / check system | x86-64 python3.13 on windows aarch64 (push) Has been cancelled
CI / check system | windows registry (push) Has been cancelled
CI / check system | python3.9 via pyenv (push) Has been cancelled
CI / check system | python3.13 (push) Has been cancelled
CI / check system | conda3.11 on macos aarch64 (push) Has been cancelled
CI / check system | conda3.8 on macos aarch64 (push) Has been cancelled
CI / check system | conda3.11 on linux x86-64 (push) Has been cancelled
CI / check system | conda3.8 on linux x86-64 (push) Has been cancelled
CI / check system | conda3.11 on windows x86-64 (push) Has been cancelled
CI / check system | conda3.8 on windows x86-64 (push) Has been cancelled
CI / check system | amazonlinux (push) Has been cancelled
CI / check system | embedded python3.10 on windows x86-64 (push) Has been cancelled
CI / benchmarks (push) Has been cancelled
When an index performs a bogus redirect or otherwise returns a different
distribution name than expected, uv currently hangs.

In the example case, requesting the simple index page for any package
returns the page for anyio. This mean querying the sniffio version map
returns only anyio entries, and the version maps resolves to an anyio
version. When the resolver makes a query for sniffio and waits for it to
resolve, the main thread finds an anyio and resolves only that in the
wait map, causing the hang.

We fix this by checking the name of the returned distribution against
the name of the requested distribution. For good measure, we add the
same check in `Request::Dist` and `Request::Installed`. For performance
and complexity reasons, we don't perform this check in the version map
itself, but only after a candidate distribution has been selected.

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-04-22 15:36:27 +00:00
Ben Beasley
45910eb6d1
Fix several occurrences of the phrase “This options” (#13053)
## Summary

Fixes several occurrences of the minor typo “This options” for “This
option.”
<!-- What's the purpose of the change? What does it do, and why? -->

## Test Plan

<!-- How was it tested? -->
Since this is just a typo fix in documentation and comment strings, no
particular testing was conducted.

## Notes

The typo fixes in `crates/uv-cli/src/lib.rs` would affect
`docs/reference/cli.md`. I assumed you might want to just re-generate
the reference documention, but fixing it up manually would look like:

```diff
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index 338fa0ff9..8851ca2c0 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -355,7 +355,7 @@ uv run [OPTIONS] [COMMAND]
 
 </dd><dt id="uv-run--no-group"><a href="#uv-run--no-group"><code>--no-group</code></a> <i>no-group</i></dt><dd><p>Disable the specified dependency group.</p>
 
-<p>This options always takes precedence over default groups, <code>--all-groups</code>, and <code>--group</code>.</p>
+<p>This option always takes precedence over default groups, <code>--all-groups</code>, and <code>--group</code>.</p>
 
 <p>May be provided multiple times.</p>
 
@@ -1757,7 +1757,7 @@ uv sync [OPTIONS]
 
 </dd><dt id="uv-sync--no-group"><a href="#uv-sync--no-group"><code>--no-group</code></a> <i>no-group</i></dt><dd><p>Disable the specified dependency group.</p>
 
-<p>This options always takes precedence over default groups, <code>--all-groups</code>, and <code>--group</code>.</p>
+<p>This option always takes precedence over default groups, <code>--all-groups</code>, and <code>--group</code>.</p>
 
 <p>May be provided multiple times.</p>
 
@@ -2492,7 +2492,7 @@ uv export [OPTIONS]
 
 </dd><dt id="uv-export--no-group"><a href="#uv-export--no-group"><code>--no-group</code></a> <i>no-group</i></dt><dd><p>Disable the specified dependency group.</p>
 
-<p>This options always takes precedence over default groups, <code>--all-groups</code>, and <code>--group</code>.</p>
+<p>This option always takes precedence over default groups, <code>--all-groups</code>, and <code>--group</code>.</p>
 
 <p>May be provided multiple times.</p>
 
@@ -2855,7 +2855,7 @@ uv tree [OPTIONS]
 
 </dd><dt id="uv-tree--no-group"><a href="#uv-tree--no-group"><code>--no-group</code></a> <i>no-group</i></dt><dd><p>Disable the specified dependency group.</p>
 
-<p>This options always takes precedence over default groups, <code>--all-groups</code>, and <code>--group</code>.</p>
+<p>This option always takes precedence over default groups, <code>--all-groups</code>, and <code>--group</code>.</p>
 
 <p>May be provided multiple times.</p>
 
```
2025-04-22 09:20:00 -04:00
Michał Górny
41727cbc54
Support using uv build-backend in the Python backend (#13049)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

Provide an in-code switch to permit using the `uv build-backend` command
rather than the default `uv-build` in the Python PEP517 backend. This
option is intended to be used by downstream packagers to provide an
option of reusing `uv` that was built already instead of having to build
a second `uv-build` executable that largely overlaps with `uv`.

Fixes #12389

## Test Plan

The option is intended for downstream consumption only, and it is tested
downstream (via attempting to build a package using the `uv_build`
backend). The backend itself is covered by tests already.

---------

Co-authored-by: konstin <konstin@mailbox.org>
2025-04-22 13:46:42 +02:00
konsti
7807e64357
Apply context filter to PEP 751 tests (#13047)
Some checks are pending
CI / integration test | uv publish (push) Blocked by required conditions
CI / integration test | uv_build (push) Blocked by required conditions
CI / check cache | ubuntu (push) Blocked by required conditions
CI / check cache | macos aarch64 (push) Blocked by required conditions
CI / check system | python on debian (push) Blocked by required conditions
CI / check system | python on fedora (push) Blocked by required conditions
CI / check system | windows registry (push) Blocked by required conditions
CI / check system | python on opensuse (push) Blocked by required conditions
CI / check system | python on rocky linux 8 (push) Blocked by required conditions
CI / check system | python on rocky linux 9 (push) Blocked by required conditions
CI / check system | pypy on ubuntu (push) Blocked by required conditions
CI / check system | pyston (push) Blocked by required conditions
CI / check system | homebrew python on macos aarch64 (push) Blocked by required conditions
CI / check system | python on macos x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86-64 (push) Blocked by required conditions
CI / check system | python3.10 on windows x86 (push) Blocked by required conditions
CI / check system | python3.13 on windows x86-64 (push) Blocked by required conditions
CI / check system | x86-64 python3.13 on windows aarch64 (push) Blocked by required conditions
CI / check system | python3.12 via chocolatey (push) Blocked by required conditions
CI / check system | conda3.11 on windows x86-64 (push) Blocked by required conditions
CI / check system | embedded python3.10 on windows x86-64 (push) Blocked by required conditions
CI / benchmarks (push) Blocked by required conditions
CI / check system | python3.9 via pyenv (push) Blocked by required conditions
CI / check system | python3.13 (push) Blocked by required conditions
CI / check system | conda3.11 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.8 on macos aarch64 (push) Blocked by required conditions
CI / check system | conda3.11 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on linux x86-64 (push) Blocked by required conditions
CI / check system | conda3.8 on windows x86-64 (push) Blocked by required conditions
CI / check system | amazonlinux (push) Blocked by required conditions
Filter out the Python patch version from `pylock.toml` exports.

Fixes #13039
2025-04-22 08:43:24 +00:00
Ed Morley
7297b9d355
Fix typo in 0.6.15 changelog entry (#13043)
`s/not/note/`
2025-04-22 09:05:31 +02:00