Commit Graph

5974 Commits

Author SHA1 Message Date
Charlie Marsh e00cc8c35f
Add bounds in `uv add --script` (#16954)
## Summary

Closes https://github.com/astral-sh/uv/issues/15544.
2025-12-03 07:37:04 -06:00
Charlie Marsh 932d7b8fce
Filter wheels from PEP 751 files based on `--no-binary` et al in `uv pip compile` (#16956)
## Summary

Like in `uv.lock`, we should omit artifacts that are filtered out by
`--no-binary` or by the target platform tags.

Closes https://github.com/astral-sh/uv/issues/13413.
2025-12-03 06:51:35 -06:00
Charlie Marsh 49b70e7225
Support `--target` and `--prefix` in `uv pip list`, `uv pip freeze`, and `uv pip show` (#16955)
## Summary

Closes https://github.com/astral-sh/uv/issues/15112.
2025-12-03 06:49:11 -06:00
Tomasz Kramkowski b1078fe595
Improve testsuite missing python version panic message (#16960)
## Summary

When the test suite panics due to a missing python version, it now
prints some helpful information to guide users to `cargo run python
install` and `CONTRIBUTING.md`

~~~
---- pip_sync::incompatible_build_constraint stdout ----

thread 'pip_sync::incompatible_build_constraint' (19737) panicked at
crates/uv/tests/it/common/mod.rs:1793:17:
Could not find Python 3.9 for test
Try `cargo run python install` first, or refer to CONTRIBUTING.md

~~~

## Test Plan

Uninstalled python3.9 and ran tests which depended on it.
2025-12-03 06:48:37 -06:00
Tomasz Kramkowski f01366bae8
Noisily allow redundant entries in `tool.uv.build-backend.module-name` (#16928)
## Summary

Fix #16906 by pruning modules or submodules which are already included
(either directly, or through a parent).

Generates warnings when this happens.

Example:

```bash session
$ uv build
Building source distribution (uv build backend)...
warning: Ignoring redundant module name(s): test_lib.bar test_lib test_lib.bar.baz test_lib.baz
Building wheel from source distribution (uv build backend)...
Successfully built dist/test-0.1.0.tar.gz
Successfully built dist/test-0.1.0-py3-none-any.whl
```

## Test Plan

Added some unit tests for the pruning function and one for the whole
build backend. Added an integration test for the warnings. Ran the full
test suite. Manually tested.

The unit test for the function doesn't cater for the fact that it
doesn't guarantee an order at the moment. I think this is fine.

---------

Co-authored-by: konsti <konstin@mailbox.org>
2025-12-03 10:05:28 +00:00
samypr100 ed63be5dab
chore(🧹): const env var usage cleanup (#16950)
## Summary

* Updates existing references to use EnvVars where usage was missing.
* Adds missing entries to env var usages, e.g. new env var declarations
in uv-trampoline, tests, etc.
* Note: this doesn't affect trampoline sizes as the end result is the
same
* Fixes versioning of `UV_HIDE_BUILD_OUTPUT`.

## Test Plan

Existing Tests. Compiled the trampolines locally to verify zero changes
(size, binary).

## Question

Will this complicate the crates publishing release process? I'm not
certain yet if it will be an issue for uv-trampoline (non-workspace
member) to reference a uv workspace member from a bump & release
perspective wrt lock files. If so, I'll revert the uv-trampoline changes
but keep the others.
2025-12-02 22:16:46 -08:00
Charlie Marsh eb65f9ff74
Add `UV_HIDE_BUILD_OUTPUT` to omit build logs (#16885)
## Summary

Closes #16804.
2025-12-02 16:43:01 -08:00
Zanie Blue e7af5838bb
Bump version to 0.9.15 (#16942) 2025-12-02 17:48:28 -06:00
Charlie Marsh 87adf14fdf
Allow reading requirements from scripts with HTTP(S) paths (#16891)
## Summary

Closes https://github.com/astral-sh/uv/issues/16890.
2025-12-02 23:42:44 +00:00
Zanie Blue 9fc07c8773
Add CPython 3.14.1 and 3.13.10 (#16941) 2025-12-02 23:36:44 +00:00
Zanie Blue 99c40f74c5
Link to the uv version in crates.io member READMEs (#16939)
Closes https://github.com/astral-sh/uv/issues/16931
2025-12-02 20:02:22 +00:00
Zanie Blue e4d193a5f8
Fix `uv-trampoline-builder` builds from crates.io by moving bundled executables (#16922)
Closes https://github.com/astral-sh/uv/issues/16836
2025-12-02 07:50:39 -06:00
samypr100 fee7f9d093
Support Git LFS with opt-in (#16143)
## Summary

Follow up to https://github.com/astral-sh/uv/pull/15563
Closes https://github.com/astral-sh/uv/issues/13485

This is a first-pass at adding support for conditional support for Git
LFS between git sources, initial feedback welcome.

e.g.
```
[tool.uv.sources]
test-lfs-repo = { git = "https://github.com/zanieb/test-lfs-repo.git", lfs = true }
```

For context previously a user had to set `UV_GIT_LFS` to have uv fetch
lfs objects on git sources. This env var was all or nothing, meaning you
must always have it set to get consistent behavior and it applied to all
git sources. If you fetched lfs objects at a revision and then turned
off lfs (or vice versa), the git db, corresponding checkout lfs
artifacts would not be updated properly. Similarly, when git source
distributions were built, there would be no distinction between sources
with lfs and without lfs. Hence, it could corrupt the git, sdist, and
archive caches.

In order to support some sources being LFS enabled and other not, this
PR adds a stateful layer roughly similar to how `subdirectory` works but
for `lfs` since the git database, the checkouts and the corresponding
caching layers needed to be LFS aware (requested vs installed). The
caches also had to isolated and treated entirely separate when handling
LFS sources.

Summary
* Adds `lfs = true` or `lfs = false` to git sources in pyproject.toml
* Added `lfs=true` query param / fragments to most relevant url structs
(not parsed as user input)
  * In the case of uv add / uv tool, `--lfs` is supported instead
* `UV_GIT_LFS` environment variable support is still functional for
non-project entrypoints (e.g. uv pip)
* `direct-url.json` now has an custom `git_lfs` entry under VcsInfo
(note, this is not in the spec currently -- see caveats).
* git database and checkouts have an different cache key as the sources
should be treated effectively different for the same rev.
* sdists cache also differ in the cache key of a built distribution if
it was built using LFS enabled revisions to distinguish between non-LFS
same revisions. This ensures the strong assumption for archive-v0 that
an unpacked revision "doesn't change sources" stays valid.

Caveats
* `pylock.toml` import support has not been added via git_lfs=true,
going through the spec it wasn't clear to me it's something we'd support
outside of the env var (for now).
* direct-url struct was modified by adding a non-standard `git_lfs`
field under VcsInfo which may be undersirable although the PEP 610 does
say `Additional fields that would be necessary to support such VCS
SHOULD be prefixed with the VCS command name` which could be interpret
this change as ok.
* There will be a slight lockfile and cache churn for users that use
`UV_GIT_LFS` as all git lockfile entries will get a `lfs=true` fragment.
The cache version does not need an update, but LFS sources will get
their own namespace under git-v0 and sdist-v9/git hence a cache-miss
will occur once but this can be sufficient to label this as breaking for
workflows always setting `UV_GIT_LFS`.

## Test Plan

Some initial tests were added. More tests likely to follow as we reach
consensus on a final approach.

For IT test, we may want to move to use a repo under astral namespace in
order to test lfs functionality.

Manual testing was done for common pathological cases like killing LFS
fetch mid-way, uninstalling LFS after installing an sdist with it and
reinstalling, fetching LFS artifacts in different commits, etc.

PSA: Please ignore the docker build failures as its related to depot
OIDC issues.

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
Co-authored-by: konstin <konstin@mailbox.org>
2025-12-02 12:23:51 +00:00
Zanie Blue 5947fb0c83
Support requirements without an extension (#16923)
Duplicate of #16889 since I merged it without realizing it was stacked.

Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
2025-12-02 11:02:24 +00:00
Charlie Marsh c8996d24a1
Cache source reads during resolution (#16888)
## Summary

If you have requirements files that are included multiple times, we can
avoid going back to disk. This also guards against accidental repeated
reads on standard input streams.
2025-12-02 09:38:56 +00:00
Charlie Marsh 2cdbf9e547
Add ROCm 6.4 to `--torch-backend=auto` (#16919)
## Summary

Closes https://github.com/astral-sh/uv/issues/16917.
2025-12-01 20:27:20 -05:00
samypr100 23b8fc9d18
Add a Windows manifest to uv binaries (#16894)
## Summary

Currently we do not include a Windows manifest on the uv binary for
windows builds. This can cause problems such as the one in
https://github.com/astral-sh/uv/issues/16877 which can limit what uv can
do for some Windows operations (e.g. symlinks) that can have
restrictions imposed by the OS unbeknownst to us and make it none
obvious to isolate the issue.

Given we already do this for the `uv-trampoline`, we should also do it
for uv. In the case of uv, I opted for explicit entries in the manifest
rather than using the defaults embed_manifest crate provides which are
not appropriate in all general cases.

The manifest now includes declarations for:
* Explicit "system" codepage declaration to retain backwards compat with
previous uv releases. We should move to utf-8 codepage in the future to
align with `uv-trampoline`, but it's arguably a breaking change in rare
cases. We shouldn't have issues with using utf-8 as we don't really rely
on *A calls to begin with.
* Explicit Windows 10+ support to ensure the executables are not treated
as a legacy, preventing application compatibility layers being wrongly
applied to it all the way back to NT 6.0 (Windows Vista). Note, other
Windows compatibility entries do not imply support, rather they imply
awareness as a preventive measure.
* Long Path support to avoid Windows operations assuming
[MAX_PATH](https://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation)
applies. This still requires the system to have long paths enabled via
``HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem@LongPathsEnabled``
dword being set to ``1`` (see
[ref](https://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation#registry-setting-to-enable-long-paths)).
* Standard invoker execution levels for CLI applications to disable UAC
virtualization after including the manifest.

The resulting manifest is the following

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" 
    xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0">
    <assemblyIdentity name="uv" type="win32" version="0.9.13.0"></assemblyIdentity>
    <asmv3:trustInfo>
        <asmv3:security>
            <asmv3:requestedPrivileges>
                <asmv3:requestedExecutionLevel level="asInvoker" uiAccess="false"></asmv3:requestedExecutionLevel>
            </asmv3:requestedPrivileges>
        </asmv3:security>
    </asmv3:trustInfo>
    <asmv3:application>
        <asmv3:windowsSettings>
            <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
        </asmv3:windowsSettings>
    </asmv3:application>
    <ms_compatibility:compatibility xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" 
        xmlns="urn:schemas-microsoft-com:compatibility.v1">
        <ms_compatibility:application xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1">
            <ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></ms_compatibility:supportedOS>
            <ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></ms_compatibility:supportedOS>
            <ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></ms_compatibility:supportedOS>
            <ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></ms_compatibility:supportedOS>
        </ms_compatibility:application>
    </ms_compatibility:compatibility>
</assembly>
```

For reference, here's `cargo`'s manifest from 1.91

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" 
    xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
        <security>
            <requestedPrivileges>
                <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
            </requestedPrivileges>
        </security>
    </trustInfo>
    <asmv3:application>
        <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2019/WindowsSettings" 
            xmlns:ws2="http://schemas.microsoft.com/SMI/2016/WindowsSettings">
            <ws2:longPathAware>true</ws2:longPathAware>
            <activeCodePage>UTF-8</activeCodePage>
        </asmv3:windowsSettings>
    </asmv3:application>
    <ms_compatibility:compatibility xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" 
        xmlns="urn:schemas-microsoft-com:compatibility.v1">
        <ms_compatibility:application xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1">
            <ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></ms_compatibility:supportedOS>
            <ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></ms_compatibility:supportedOS>
            <ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></ms_compatibility:supportedOS>
            <ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></ms_compatibility:supportedOS>
        </ms_compatibility:application>
    </ms_compatibility:compatibility>
</assembly>
```

Closes #16877

## Test Plan

Before changes on Windows 11 25H2 (without
SeCreateSymbolicLinkPrivilege)

```console
$ uv init
$ uv add jupyterlab-widgets==3.0.16 --link-mode=symlink
...
Resolved 2 packages in [TIME]
error: Failed to install: jupyterlab_widgets-3.0.16-py3-none-any.whl (jupyterlab-widgets==3.0.16)
  Caused by: failed to symlink file from [CACHE_DIR]\archive-v0\aQcqEjLJAkVwuSzohqymc\jupyterlab_widgets-3.0.16.data\data\share\jupyter\labextensions\@jupyter-widgets\jupyterlab-manager\static\packages_base_lib_index_js-webpack_sharing_consume_default_jquery_jquery.5dd13f8e980fa3c50bfe.js to [ROOT]\.venv\Lib\site-packages\jupyterlab_widgets-3.0.16.data\data\share\jupyter\labextensions\@jupyter-widgets\jupyterlab-manager\static\packages_base_lib_index_js-webpack_sharing_consume_default_jquery_jquery.5dd13f8e980fa3c50bfe.js: A required privilege is not held by the client. (os error 1314)
```

Before changes on Windows 11 25H2 (with SeCreateSymbolicLinkPrivilege)

```console
$ uv init
$ uv add jupyterlab-widgets==3.0.16 --link-mode=symlink
...
Resolved 2 packages in [TIME]
error: Failed to install: jupyterlab_widgets-3.0.16-py3-none-any.whl (jupyterlab-widgets==3.0.16)
  Caused by: failed to symlink file from [CACHE_DIR]\archive-v0\aQcqEjLJAkVwuSzohqymc\jupyterlab_widgets-3.0.16.data\data\share\jupyter\labextensions\@jupyter-widgets\jupyterlab-manager\static\packages_base_lib_index_js-webpack_sharing_consume_default_jquery_jquery.5dd13f8e980fa3c50bfe.js to [ROOT]\.venv\Lib\site-packages\jupyterlab_widgets-3.0.16.data\data\share\jupyter\labextensions\@jupyter-widgets\jupyterlab-manager\static\packages_base_lib_index_js-webpack_sharing_consume_default_jquery_jquery.5dd13f8e980fa3c50bfe.js: The parameter is incorrect. (os error 87)
```

After changes on Windows 11 25H2 (with or without
SeCreateSymbolicLinkPrivilege)

```console
$ uv init
$ uv add jupyterlab-widgets==3.0.16 --link-mode=symlink
...
Resolved 2 packages in [TIME]
Installed 1 package in [TIME]
 + jupyterlab-widgets==3.0.16
```
2025-12-01 14:02:35 -06:00
Zanie Blue 082be90177
Use 0o666 permissions for flock files instead of 0o777 (#16845)
This removes executable permissions while retaining global read / global
write.

It's been suggested we should use 0o644 instead, dropping the global
write permissions (i.e., just the owner can write), but since we're
taking an exclusive lock I don't think that would work and we'd regress
the issue that was solved by updating the permissions. I think we'll
need to revisit the locking scheme if that's the goal, but regardless,
this seems like a net improvement.
2025-12-01 12:09:43 -06:00
Tomasz Kramkowski efa47adefb
Respect `NO_COLOR` and always show the command as a header when paging `uv help` output (#16908)
## Summary

Fix #16879 and address an additional issue where the pager prompt would
be bold regardless of NO_COLOR.

<img width="1437" height="483" alt="image"
src="https://github.com/user-attachments/assets/7234129a-364b-40c6-834a-57ac34212925"
/>

## Test Plan

Ran the test suite and manually verified against `less` 679 and `busybox` v1.34.1.

Checked with and without `NO_COLOR` on both "normal" `less`, `busybox` `less`, and `more`.
2025-12-01 18:00:43 +00:00
Zsolt Dollenstein 05814f9cd5
Bump version to 0.9.14 (#16909) 2025-12-01 11:52:15 -05:00
Zsolt Dollenstein 6b00d6522c
Attach subcommand to User-Agent string (#16837) 2025-12-01 10:29:54 -05:00
Sidharth Anil 5773b12fa9
Isolating test from accessing global git credential helper config (#16895)
## Summary
Resolves: https://github.com/astral-sh/uv/issues/1980

Added a utility function to TestContext called
**with_git_credential_helper_blocked** that isolates the test from
accessing the credential helper value defined in global/system git
config. It does so, by writing to a file .gitconfig in the temporary
home_dir that is created as part of the TestContext.

## Test Plan
Tested it by running the test
pip_install::install_git_private_https_pat_and_username, and making sure
it doesn't affect the keyring.

## Note:
The commit hash for the uv-private-package seems to have changed.
Kindly, ensure that the modification related to that is correct.
2025-12-01 12:41:21 +01:00
Charlie Marsh 0ae54dbd8a
Use `UV_WORKING_DIR` for consistency (#16884)
## Summary

Closes https://github.com/astral-sh/uv/issues/16870.
2025-11-30 15:59:05 +00:00
Ben Berry-Allwood c29304aaca
Prefer updating existing `.zshenv` over creating a new one in `tool update-shell` (#16866) 2025-11-29 22:13:05 +00:00
Charlie Marsh 5498e4d6f6
Respect `-e` flags in `uv add` (#16882)
## Summary

Closes https://github.com/astral-sh/uv/issues/16872.
2025-11-28 10:03:05 -05:00
Charlie Marsh e2bda1173e
Allow earlier post releases with exclusive ordering (#16881)
## Summary

Given (e.g.) `<0.12.0.post2`, we need to omit pre-releases on `0.12.0`,
but include post-releases.

Closes https://github.com/astral-sh/uv/issues/16868.
2025-11-28 09:50:49 -05:00
Zanie Blue 735b87004c
Bump version to 0.9.13 (#16862) 2025-11-26 15:12:54 +00:00
Zanie Blue ca62066194
Revert "Allow `--with-requirements` to load extensionless inline-metadata scripts" (#16861)
Reverts https://github.com/astral-sh/uv/pull/16805 /
https://github.com/astral-sh/uv/pull/16744

This also invalidates

- https://github.com/astral-sh/uv/pull/16855
- #16857 

There's probably a way we can make this work, but detecting whether a
file is safe to read repeatedly is non-trivial, `is_file` returns `true`
for `/dev/stdin` on macOS so the approach from #16857 is not sufficient.
I spent a while trying to add `is_char_device` detection for macOS but
unfortunately that didn't work.
2025-11-26 14:57:45 +00:00
Charlie Marsh 4d747f6e86
Avoid eagerly reading input streams in `-r` (#16857)
## Summary

I think the comment should explain it.

Closes https://github.com/astral-sh/uv/issues/16856.
2025-11-25 22:55:08 -05:00
Nicola Soranzo 4bb219f8b9
Fix ``uv pip install -r /dev/stdin`` (#16855)
## Summary

Fix ``uv pip install -r /dev/stdin`` which was broken in uv 0.9.12 by
https://github.com/astral-sh/uv/pull/16805 .

Example of the issue:

```
$ echo "flask" | uv pip install -r /dev/stdin
warning: Requirements file `/dev/stdin` does not contain any dependencies
Audited in 8ms
```

Note that "upstream" ``pip install`` does support `-r /dev/stdin` and
doesn't support `-r -` .

## Test Plan

2 new tests added.
2025-11-26 03:13:32 +00:00
Charlie Marsh bfdee80f6c
Validate URL wheel tags against `Requires-Python` and required environments (#16824)
## Summary

Closes #16818.
2025-11-25 20:05:58 -05:00
Zanie Blue 17c1061676
Fix the links to uv in crates.io member READMEs (#16848) 2025-11-25 18:47:32 +00:00
Zanie Blue d735e27750
Drop unpublished crates from the uv crates.io README (#16847) 2025-11-25 18:46:02 +00:00
Zanie Blue 0fb1233363
Bump version to 0.9.12 (#16840) 2025-11-24 23:22:12 +00:00
William Woodruff 7b3199f07c
Collect and upload PEP 740 attestations during `uv publish` (#16731)
Co-authored-by: konsti <konstin@mailbox.org>
2025-11-24 16:47:15 -05:00
Zanie Blue 1a6238c835
Disable `test_simultaneous_multiple_create_delete_single_thread` on Windows (#16834)
Closes https://github.com/astral-sh/uv/issues/16096
2025-11-24 15:10:34 +00:00
Zanie Blue 7b8240dca9
Generate a README for crate members too (#16812)
We skip members with existing READMEs for now.

Follows #16809 and #16811
2025-11-21 15:44:05 -06:00
Zanie Blue ba46a448d4
Enumerate workspace members in the uv crate README (#16811) 2025-11-21 13:44:59 -06:00
Zanie Blue 1de0cbea94
Use the word "internal" in crate descriptions (#16810)
ref
https://github.com/astral-sh/uv/pull/16809#pullrequestreview-3494007588
2025-11-21 13:22:47 -06:00
Zanie Blue e550f960e8
Add a crates.io README for uv (#16809) 2025-11-21 13:05:26 -06:00
Charlie Marsh f7f159234f
Allow `--with-requirements` to load extensionless inline-metadata scripts (#16805)
Reverts astral-sh/uv#16802
2025-11-21 11:53:41 -05:00
Zanie Blue 563438f13d
Fix documentation links for crates (#16801)
Part of https://github.com/astral-sh/uv/issues/4392

We shouldn't link to PyPI, and dropping the workspace-level
documentation link should mean that we get the auto-generated `docs.rs`
links.
2025-11-21 10:44:58 -06:00
konsti 9b251c5667
Don't pass `DEFAULT_BACKEND` around (#16807)
This seem to have happened cause a function was refactored, and the
static wasn't inlined.
2025-11-21 15:29:47 +00:00
Charlie Marsh 985abdc555
Revert "Allow `--with-requirements` to load extensionless inline-metadata scripts" (#16802)
Reverts astral-sh/uv#16744. I'll un-revert and fix tomorrow.
2025-11-21 04:24:05 +00:00
liam f3cdfac93e
Allow `--with-requirements` to load extensionless inline-metadata scripts (#16744)
Resolves https://github.com/astral-sh/uv/issues/16732

This diff treats extensionless files that contain
[PEP 723](https://peps.python.org/pep-0723/) metadata as scripts when
resolving `--with-requirements`, so inline metadata works even when the
script doesn’t end in `.py`.

---------

Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
2025-11-20 21:33:41 -05:00
liam b086eabe5f
Prevent `uv export` from overwriting `pyproject.toml` (#16745)
Currently, it's possible for `uv export` to overwrite someones
`pyproject.toml`. This diff simply rejects project files passed in with
`-o`, so we avoid doing that.

---------

Co-authored-by: konstin <konstin@mailbox.org>
Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
2025-11-20 21:33:23 -05:00
Charlie Marsh c5c44168e0
Cache Dependabot lookup (#16795)
## Summary

Small nit, but I wanted to avoid doing this access in the hot path.
(Probably not important in practice.)

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-11-20 16:24:16 -06:00
Zanie Blue 4be1e0a83c
Bump version to 0.9.11 (#16794) 2025-11-20 16:24:01 -06:00
Zanie Blue dfe89047bb
Publish to `crates.io` (#16770) 2025-11-20 21:26:44 +00:00
github-actions[bot] e799a088a5
Sync latest Python releases (#16792)
Automated update for Python releases.

---------

Co-authored-by: jjhelmus <1050278+jjhelmus@users.noreply.github.com>
Co-authored-by: Jonathan Helmus <jjhelmus@gmail.com>
2025-11-20 20:27:40 +00:00
Zanie Blue aebd7578bb
Add `uv workspace list --paths` (#16776)
I initially thought I didn't need this, but in some contexts, the
workspace member name is not useful at all and I just want to iterate
over the paths without composing with `uv workspace dir --package
<name>`
2025-11-20 13:44:57 -06:00
liam 79bfa2b4cd
Preserve end-of-line comment whitespace when editing `pyproject.toml` (#16734)
Resolves https://github.com/astral-sh/uv/issues/16719

`uv add` collapses multiple spaces before inline comments in
`[project.dependencies]`, causing unrelated diffs and moving comments
onto the wrong columns. This diff captures the exact whitespace padding
that preceded each end-of-line comment when parsing the array and reuses
it when formatting.

---------

Co-authored-by: konstin <konstin@mailbox.org>
2025-11-20 20:15:27 +01:00
liam 5b4446f086
Fix `uv init` author serialization via `toml_edit` inline tables (#16778) 2025-11-20 14:10:12 -05:00
Tom Schafer fd7e6d0a05
Add SBOM export support (#16523)
Co-authored-by: Will Rollason <william.rollason@snyk.io>
2025-11-20 12:52:31 -05:00
Ryan Blue 4a867dc60b
Fix status messages without TTY (#16785)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

#12175 changed the behavior of `on_request_complete` when stderr is not
a tty to output `Downloading`/`Uploading` (via `Direction::as_str`).
This fixes it to output `Downloaded`/`Uploaded` again.

## Test Plan

Tested locally to verify new output.

Old:
```
$ uv sync --no-cache 2>&1 | tee /dev/null
Using CPython 3.14.0
Creating virtual environment at: .venv
Resolved 12 packages in 19ms
Downloading numpy (15.8MiB)
Downloading matplotlib (9.4MiB)
Downloading fonttools (4.6MiB)
Downloading pillow (6.7MiB)
Downloading kiwisolver (1.4MiB)
 Downloading kiwisolver
 Downloading fonttools
 Downloading pillow
 Downloading matplotlib
 Downloading numpy
```
New:
```
$ uv sync --no-cache 2>&1 | tee /dev/null
Using CPython 3.14.0
Creating virtual environment at: .venv
Resolved 12 packages in 3ms
Downloading numpy (15.8MiB)
Downloading fonttools (4.6MiB)
Downloading matplotlib (9.4MiB)
Downloading kiwisolver (1.4MiB)
Downloading pillow (6.7MiB)
 Downloaded kiwisolver
 Downloaded pillow
 Downloaded fonttools
 Downloaded matplotlib
 Downloaded numpy
```
2025-11-20 15:14:42 +01:00
Zanie Blue fc0cf90795
Fix the preview warning on `uv workspace dir` (#16775) 2025-11-19 13:20:25 -06:00
Zanie Blue 3ac43e8d15
Disable always-authenticate when running under Dependabot (#16773)
Dependabot appears to run a proxy which intercepts all requests and adds
credentials — credentials are _not_ provided via the CLI or environment
variables and there's no way for a user to do so. This means that when
`authenticate = "always"` is used (or when the index URL is on a pyx
domain), uv will fail even though Dependabot may intercept the request
and add credentials.

See
https://github.com/dependabot/dependabot-core/#private-registry-credential-management
2025-11-18 15:43:44 -06:00
konsti 44f5a14f40
Bump version to 0.9.10 (#16762)
Motivated by https://github.com/astral-sh/uv/pull/16759

Doesn't contain https://github.com/astral-sh/uv/pull/16752, but that one
doesn't seem critical
2025-11-17 16:29:14 +00:00
Zanie Blue 07e03ee776
Add `uv workspace list` to list workspace members (#16691)
I'm a little wary here, in the sense that it might be silly to have a
command that does something so simple that's covered by `uv workspace
metadata`? but I think this could be stabilized much faster than `uv
workspace metadata` and makes it easier to write scripts against
workspace members.

---------

Co-authored-by: liam <liam@scalzulli.com>
2025-11-17 09:35:50 -06:00
konsti 2d75aca8e3
Don't check file URLs for ambiguously parsed URLs (#16759)
Fixes https://github.com/astral-sh/uv/issues/16756
Follow-up for https://github.com/astral-sh/uv/pull/16622

I noticed that rustfmt couldn't handle the check, so I moved the code
around in the first two commits.
2025-11-17 14:16:13 +00:00
samypr100 bf99f0a195
Add support for SSL_CERT_DIR (#16473)
## Summary

Closes https://github.com/astral-sh/uv/issues/16414

Adds support for the standard
[SSL_CERT_DIR](https://docs.openssl.org/3.6/man3/SSL_CTX_load_verify_locations)
which has gained recent proper support from
[rustls-native-certs](https://github.com/rustls/rustls-native-certs/pull/187)
in v0.8.2.

In addition, this PR clarifies documentation around `SSL_CERT_FILE` and
`SSL_CERT_DIR` when used in combination with `UV_NATIVE_TLS` as
mentioned in
https://github.com/astral-sh/uv/issues/16412#issuecomment-3434927201

## Test Plan

Manually tested with custom cert chains in multiple directories and
loading them via SSL_CERT_DIR. We didn't have tests for `SSL_CERT_FILE`
or `SSL_CERT_DIR` environment variables so I added a basic one using our
own test-only certificate generation and dummy https server. I also
moved some things around for better reuse.
2025-11-16 11:48:31 -06:00
Meitar Reihan b9826778b9
Support http/https URLs in `uv python --python-downloads-json-url` (#16542)
continuation PR based on #14687

---------

Co-authored-by: Geoffrey Thomas <geofft@ldpreload.com>
Co-authored-by: Aria Desires <aria.desires@gmail.com>
2025-11-14 17:51:24 -05:00
Meitar Reihan 7f4d8c67a8
Account for `python_downloads_json_url` on Pre-release Python version warnings (#16737)
Solves #16711
2025-11-14 15:12:35 -06:00
liam 1a14d595fd
Error when a `project.license-files` glob matches nothing (#16697)
Resolves https://github.com/astral-sh/uv/issues/16693

[`PEP 639`](https://peps.python.org/pep-0639/#add-license-files-key)
requires build tools to error if any user-specified
`project.license-files` glob fails to match a file, but uv currently
allows the build to succeed and produces empty `.dist-info/licenses/`
directories.

This PR enforces the spec by tracking matches for each glob during
metadata generation, raising a clear
validation error when one is unmatched.
2025-11-14 11:02:04 +01:00
Zanie Blue f5ce5b47c8
Add support for `--upgrade` in `uv python install` (#16676)
This allows us to suggest `uv python install --upgrade 3.14` as the
canonical way to get the latest patch version of a given Python
regardless of whether it is installed already. Currently, you can do `uv
python upgrade 3.14` and it will install it, but I'd like to remove that
behavior as I find it very surprising.
2025-11-13 09:55:48 -06:00
liam e28dc62358
Enforce UTF‑8-encoded license files during `uv build` (#16699)
I noticed this when working on
https://github.com/astral-sh/uv/pull/16697.

[PEP 639](https://peps.python.org/pep-0639/#add-license-files-key)
expects tools to ship license texts as UTF‑8, but previously `uv build`
would quietly include any binary blob listed under
`project.license-files`.

I have no clue what is going on with `rustfmt` for this file, but it
seems that when I add the check, it wants to reformat a bunch of
surrounding stuff.

The relevant part to look at is:

```rust
for license_file in &license_files {
    let file_path = root.join(license_file);
    let bytes = fs_err::read(&file_path)?;
    if str::from_utf8(&bytes).is_err() {
        return Err(ValidationError::LicenseFileNotUtf8(license_file.clone()).into());
    }
}
```

where we validate all collected license files before proceeding.

---------

Co-authored-by: konstin <konstin@mailbox.org>
2025-11-13 12:49:59 +00:00
Mikayla Thompson 88811553e4
`pip install --target` (and `sync`) install python if necessary (#16694)
## Summary

As described in https://github.com/astral-sh/uv/issues/12229, `pip
install` with `--target` or `--prefix` seem like they should install the
necessary python version if it doesn't exist, but they currently don't.

Most minimal reproduction is something like:
```
> uv python uninstall 3.13
...
> uv pip install anyio --target target-dir --python 3.13
error: No interpreter found for Python 3.13 in virtual environments, managed installations, or search path
```

This also fails without `--target`, but a venv is expected in that case,
so the with `--target`/`--prefix` is the only version that needs to be
fixed. The same mechanism occurs for `uv pip sync` as well.

## Test Plan

Added tests for install and sync that failed before fix and now pass.

---------

Signed-off-by: Mikayla Thompson <mrt@mikayla.codes>
2025-11-12 15:42:52 -07:00
Oshadha Gunawardena aec42540a1
Fix handling of `python install --default` for pre-release Python versions (#16706)
## Summary

Fixes `--default` not creating default executable links for pre-release
Python versions.

When using `--default` with a pre-release version like `3.15.0a1`, the
code was checking `matches_installation()` against the download request
instead of the original user request. This caused the check to fail
since the download request doesn't match pre-release versions the same
way.

Changed it to use `installation.satisfies(&first_request.request)` when
`--default` is used, which checks against the original user request.

Fixes #16696

## Test Plan

Added `python_install_default_prerelease` test that installs Python 3.15
with `--default` and verifies all three executable links (`python3.15`,
`python3`, `python`) are created. The test skips gracefully if 3.15
isn't available.

All existing tests pass.
2025-11-12 12:33:58 -06:00
Zanie Blue 4fac4cb7ed
Bump version to 0.9.9 (#16708) 2025-11-12 18:14:44 +00:00
Zsolt Dollenstein e96354a6dd
Always attach linehaul data (#16705) 2025-11-12 17:10:15 +00:00
Charlie Marsh 2c0d166260
Add `only-emit-workspace` and similar variants to `uv export` (#16681)
## Summary

This is useful for scenarios in which you want to emit the workspace
dependencies, but nothing else.
2025-11-12 16:51:45 +00:00
William Woodruff ae1edef9c0
Reject ambiguously parsed URLs (#16622)
Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-11-12 16:27:57 +00:00
bigmoonbit 82c612704a
chore: fix typo in crates/uv-virtualenv/README.md (#16700)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

fix typo in crates/uv-virtualenv/README.md


<!-- What's the purpose of the change? What does it do, and why? -->

## Test Plan

<!-- How was it tested? -->

No need.

Signed-off-by: bigmoonbit <bigmoonbit@outlook.com>
2025-11-12 09:45:37 -06:00
Zsolt Dollenstein c16a5fd630
Fix shell-specific test snapshots (#16688)
## Summary

Two tests were failing when run with `SHELL=fish`:
1. `create_venv_current_working_directory` failed because the "activate"
filter didn't apply properly when the venv was in the CWD. This PR fixes
the filter.
2. `tool_install_warn_path` failed because the messages are different
between fish and bash. This PR hardcodes `SHELL=fish`.

## Test Plan

CI
2025-11-12 07:55:33 -06:00
liam d32cc638d1
Deny stdout/stderr printing in `uv` crate via clippy (#16695)
Follow-up from https://github.com/astral-sh/uv/pull/16690, in `uv` every
command should be using `write!(...)/writeln!(...)` with the `Printer`
abstraction instead of bypassing control with the standard printing
functions. This lint ensures that.
2025-11-12 07:54:52 -06:00
Zsolt Dollenstein 2de987ed37
Skip python_install_emulated_macos except on ARM64 macos with rosetta (#16687)
## Summary

This test isn't useful on non-arm64 macs, and it outright fails if
rosetta isn't installed.

## Test Plan

Run it on my rosetta-stripped macbook
2025-11-12 07:48:16 -06:00
liam 1b38b47a3f
Warn on managed prerelease interpreters when a stable build is available (#16619)
Resolves https://github.com/astral-sh/uv/issues/16616

This PR detects managed prerelease interpreters during discovery and
warns when a matching stable build is available, wiring the new helper
into `PythonInstallation::find`, `find_best`, and `find_or_download`.
2025-11-12 07:45:31 -06:00
konsti e36bf634ba
Add iOS support for Python discovery (#16686)
iOS support exist nominally
(https://github.com/astral-sh/uv/pull/15640), but Python discovery
currently fails.
2025-11-12 11:03:27 +00:00
Zanie Blue 63df2cdfe9
Minor fixups to `uv workspace metadata` (#16692) 2025-11-11 20:41:26 +00:00
Mikayla Thompson 00e2a0e54d
Replace println with Printer for all `dir` commands & workspace dir followups (#16690)
## Summary

1. Discussed in review of #16678 that println should be replaced by
using `printer`. The `println` pattern was pretty consistent across all
the `dir` commands, so I've updated all of them in this PR (there are
some usages of `println` outside of `uv/src/commands` that I didn't
touch -- the use cases there seemed more complex and nuanced).
2. I missed two comments in the previous PR before merging, so updates
from those are in here as well.

## Test Plan

No behavior changes, existing tests for all commands pass.

---------

Signed-off-by: Mikayla Thompson <mrt@mikayla.codes>
2025-11-11 14:36:31 -06:00
Mikayla Thompson b81060674e
`workspace dir` command (#16678)
Addresses https://github.com/astral-sh/uv/issues/13636

Prints the path to the workspace root by default, and any of the child
packages if requested.

I looped it into the same preview flag as `workspace metadata`, given
how closely related they are.

## Summary

```
─> uv workspace dir
/Users/mikayla/code/uv/dev-envs

─> uv workspace dir --package foo-proj
/Users/mikayla/code/uv/dev-envs/foo-proj

─> uv workspace dir --package bar-proj
error: Package `bar-proj` not found in workspace.
```

## Test Plan

Unit tests added.

---------

Signed-off-by: Mikayla Thompson <mrt@mikayla.codes>
Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-11-11 12:30:39 -07:00
konsti 92c2bfcca0
Remove unnecessary `DisplaySafeUrl::from` (#16689)
For #16622
2025-11-11 19:12:20 +00:00
liam 63ab247765
Allow explicit values with `uv version --bump` (#16555)
Resolves https://github.com/astral-sh/uv/issues/16427

This PR updates `uv version --bump` so you can pin the exact number
you’re targeting, i.e. `--bump patch=10` or `--bump dev=42`. The
command-line interface now parses those `component=value` flags, and the
bump logic actually sets the version to the number you asked for.
2025-11-11 12:27:32 -05:00
Zanie Blue 3ccad58166
Add `uv workspace metadata` (#16516)
This adds the scaffolding for a `uv workspace metadata` command, as an
equivalent to `cargo metadata`, for integration with downstream tools. I
didn't do much here beyond emit the workspace root path and the paths of
the workspace members. I explored doing a bit more in #16638, but I
think we're actually going to want to come up with a fairly
comprehensive schema like `cargo metadata` has. I've started exploring
that too, but I don't have a concrete proposal to share yet.

I don't want this to be a top-level command because I think people would
expect `uv metadata <PACKAGE>` to show metadata about arbitrary packages
(this has been requested several times). I also think we can do other
things in the workspace namespace to make trivial integrations simpler,
like `uv workspace list` (enumerate members) and `uv workspace dir`
(show the path to the workspace root).

I don't expect this to be stable at all to start. I've both gated it
with preview and hidden it from the help. The intent is to merge so we
can iterate on it as we figure out what integrations need.
2025-11-11 15:46:01 +00:00
Charlie Marsh 5b517bb966
Remove Git-based dependency for tl (#16679)
## Summary

I published our own fork, since our PR had been lingering for over a
year: https://crates.io/crates/astral-tl
2025-11-11 08:41:13 -06:00
Mikayla Thompson f22af0f88a
Deprecate `--project` arg for init (#16674)
Addresses https://github.com/astral-sh/uv/issues/15790

## Summary

After discussion, the functionality of `--project` vs `--directory` was
quite unclear in this case, so deprecating `--project` for `init` is
probably the clearest behavior option. This is a breaking change, so it
requires being under preview before being rolled out fully.

Included in the PR now:
- new feature flag (`init --project` is deprecated if `--preview` or
`--preview-features deprecate-project-for-init` are provided)
- tests (for `--directory` behavior, as well as the current warning and
future error)
- documentation updated in docs/concepts/projects/init.md

---------

Signed-off-by: Mikayla Thompson <mrt@mikayla.codes>
2025-11-10 16:33:08 -07:00
Mathieu Kniewallner 9a21897f3d
feat(cli): expose `UV_NO_DEFAULT_GROUPS` environment variable (#16645)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

Similarly to #16529 that adds `UV_NO_GROUP`, this adds
`UV_NO_DEFAULT_GROUPS` that does the same as `--no-default-groups`. This
can be useful on the CI, to disable default groups on a job without
having to set the argument in all commands that could trigger a sync
(for instance
[here](8757b318e9/.github/workflows/main.yml (L105-L116))).

## Test Plan

Snapshot tests.

---------

Co-authored-by: samypr100 <3933065+samypr100@users.noreply.github.com>
2025-11-10 14:43:48 -06:00
Charlie Marsh c1c1950dce
Add support for the Simple index API top-level route (#16656)
## Summary

At present, we only have support for the detail routes (e.g.,
`https://pypi.org/simple/requests`), but not the top-level index route
(e.g., `https://pypi.org/simple/`). I need this for some downstream work
so pulling it into its own PR.
2025-11-10 14:50:19 -05:00
Charlie Marsh ce4a47a2e0
Remove `torch-model-archiver` and `torch-tb-profiler` from PyTorch backend (#16655)
## Summary

These are present on the PyTorch index, but only at very old versions.
The PyPI versions are newer, and seemingly these don't need to be built
against CUDA, etc.

Closes https://github.com/astral-sh/uv/issues/16651.
2025-11-10 10:26:12 -05:00
Zanie Blue 60196bc3ce
Remove stale comment (#16667)
This happens in `from_settings` instead
2025-11-10 14:55:04 +00:00
liam c826f2b042
Fix pixi environment detection by recognizing Conda prefixes with `conda-meta/pixi` (#16585)
Resolves https://github.com/astral-sh/uv/issues/16295

This PR updates the Conda base-environment heuristic to recognize
Pixi-managed environments by checking for the `conda-meta/pixi` marker
file. Pixi default environments now resolve as isolated child
environments instead of system installations, restoring the expected uv
pip behavior without the `--system` flag.
2025-11-09 22:16:17 -06:00
Zanie Blue 2d9fe7ca70
Pin lock futures (#16643)
These futures are quite large (~16,000 bytes) and adding new fields to
the `ResolverOptions` in another pull request caused a lint error from
Clippy.
2025-11-09 10:37:16 -06:00
Pavel Logan Dikov caf49f845f
Use `.rcdata` to store trampoline type + path to python binary (#15068)
`.rsrc` is the idiomatic way of storing metadata and non-code resources
in PE
binaries. This should make the resulting binaries more robust as they
are no longer
dependent on the exact location of a certain magic number.

Addresses: #15022

## Test Plan

Existing integration test for `uv-trampoline-builder` + addition to
ensure robustness
to code signing.

---------

Co-authored-by: samypr100 <3933065+samypr100@users.noreply.github.com>
Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-11-09 08:12:40 -06:00
github-actions[bot] 1b7faafd7a
Sync latest Python releases (#16505)
Automated update for Python releases.

Co-authored-by: zanieb <2586601+zanieb@users.noreply.github.com>
2025-11-08 10:16:21 -06:00
Zanie Blue 5983a8876b
Refactor to remove some cruft from `ExcludeNewer` propagation (#16641)
I think using a wire here is less convoluted.
2025-11-08 09:44:17 -06:00
Zanie Blue 85c5d32284
Bump version to 0.9.8 (#16636) 2025-11-07 11:45:22 -06:00
Zanie Blue bfecc9902e
Fix inclusive constraints on available package versions in resolver errors (#16629)
Closes https://github.com/astral-sh/uv/issues/16626
2025-11-07 09:23:37 -06:00
Zanie Blue 5e181d36ef
Show help on `uv build -h` (#16632) 2025-11-07 16:19:40 +01:00
Charlie Marsh 4740d267e9
Remove fast path from `uv-git` fetch (#16607)
## Summary

Now that we perform this fast-path in
`crates/uv-distribution/src/source/mod.rs`, I _think_ the fast-path here
is no longer used? In my testing, we only actually took this path when
the fast-path _already_ failed (and thus it would fail again, wasting
time).
2025-11-06 22:18:05 -06:00
Haaris Rahman e5c10cd45d
Fix typo in uv tool list doc (#16625)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary


Fixed a typo in the docs.

Regenerated the docs, with the fix.


<!-- What's the purpose of the change? What does it do, and why? -->
2025-11-06 22:06:17 -06:00