Commit Graph

7702 Commits

Author SHA1 Message Date
Aria Desires 7ab70a2b6b update dist config 2025-10-23 16:55:58 -04:00
renovate[bot] 157f08498c
Update Artifact GitHub Actions dependencies 2025-10-23 15:08:38 +00:00
Zanie Blue 0959763a82
Improve hint on `pip install --system` when externally managed (#16392)
I had some qualms with https://github.com/astral-sh/uv/pull/16318

1. The snapshot was specific to uv's managed interpreter due to
inclusion of the externally-managed output. This will break downstream
distros. We either need to filter the message, or, as done here, install
a managed interpreter.
2. It had a custom filter for the interpreter path, which we shouldn't
need. If needed, we should fix that in the test context.
3. We already had an implicit hint to create a virtual environment. The
change in styling of the new hint hint following it is confusing. It's
also confusing to hint creating a virtual environment when `--system`
was used.
4. There were unresolved requested changes to the language for the
message / it didn't fit stylistic with our existing ones.
5. The message was also very confusing for a uv-managed interpreter,
which is both a "system" Python interpreter (in that it's global) and
the opposite of a "system" interpreter per UV_PYTHON_PREFERENCE.

Also problematic, but not addressed here, is that there are other
commands that display an externally-managed message, e.g., `uv pip
sync`, but #16318 was just limited to `pip install`. We should not just
implement this in one place — I'll open a tracking issue to consolidate
and reuse the logic.
2025-10-21 17:59:01 +00:00
Charles-Meldhine Madi Mnemoi 225bffbb6c
Running `uv lock --check` with outdated lockfile will print that `--check` was passed, instead of `--locked` (#16322)
Hello,

# Summary

This PR fixes the confusing error message when running `uv lock --check`
with an outdated lockfile.

Previously, the error message incorrectly stated that `--locked` was
provided, even when the user used `--check`.

Now, the error message correctly indicates which flag was used: either
`--check` or `--locked`.

This closes #14105.

# Test plan

- I updated the existing integration test (`check_outdated_lock` in
`lock.rs`) to verify the new error message includes the correct flag.
- I ran existing tests to ensure I have no introduced regressions for
other commands.
2025-10-21 12:46:10 -05:00
William Woodruff 509a1e8ff6
CHANGELOG: include security note + entry for 0.9.5 (#16393) 2025-10-21 13:33:28 -04:00
William Woodruff d5f39331a7
Bump version to 0.9.5 (#16389) 2025-10-21 12:14:22 -04:00
konsti 1a53701d1d
Deactivate zizmor due to GitHub ratelimiting (#16390) 2025-10-21 15:36:20 +00:00
William Woodruff ae450662d1
deps: bump astral-tokio-tar to 0.5.6 (#16387) 2025-10-21 10:55:58 -04:00
konsti 38412a675e
Remove outdated aarch64 musl note (#16385)
We now build aarch64 musl Python distributions. I've also removed the
rye mention since it's now officially deprecated.
2025-10-21 16:08:37 +02:00
Samuel Rigaud 2fc5fe2ac0
fix small typos (#16357)
## Summary

I tried to fix minor typos in the project

---------

Co-authored-by: Samuel Rigaud <rigaud@gmail.com>
Co-authored-by: konstin <konstin@mailbox.org>
2025-10-21 12:11:59 +00:00
Jordan Borean 17155c4cca
Fix backtick escaping for PowerShell (#16307)
## Summary
Fixes the logic for escaping a double quoted string in PowerShell by not
escaping a backslash but escaping the Unicode double quote variants that
PowerShell treats the same as the ASCII double quotes.

<img width="685" height="99" alt="image"
src="https://github.com/user-attachments/assets/ac1368c2-d915-4e49-b67f-ac71ee0f7d46"
/>

## Test Plan
There does not seem to be any tests for this. I'm fairly new to rust but
happy to add some if someone can point me in the right direction.

---------

Co-authored-by: Aria Desires <aria.desires@gmail.com>
2025-10-21 10:16:21 +00:00
Andrei Berenda 51e8da2d1c
Move parsing http retries to EnvironmentOptions (#16284)
## Summary
- Move  parsing `UV_HTTP_RETRIES` to `EnvironmentOptions`

Relates https://github.com/astral-sh/uv/issues/14720

## Test Plan

- Tests with existing tests
2025-10-21 11:14:37 +02:00
Charles-Meldhine Madi Mnemoi 29cec24d5c
fix: Add a hint on `uv pip install` failure if the `--system` flag is used to select an externally managed interpreter (#16318)
Hello,

# Summary
This PR makes the error message clearer when you try to install packages
into an externally managed Python environment with the `--system` flag.
Now, instead of just failing, the error explains that you're hitting
this because you explicitly used `--system`.

This closes #15639.

# Test plan

- I added a new integration test (`install_with_system_interpreter` in
`pip_install.rs`) that checks the error message includes the hint.
- I tried to run `uv pip install --system -r requirements.txt` to see
the actual error message in action, but had permission issues.
2025-10-21 07:46:39 +00:00
github-actions[bot] ed65c2482c
Sync latest Python releases (#16246)
Automated update for Python releases.

Co-authored-by: zanieb <2586601+zanieb@users.noreply.github.com>
2025-10-21 00:41:53 +00:00
eun2ce e0fe38eabb
Improve 403 Forbidden error message to indicate package may not exist (#16353)
Fixes #16340

## Summary

Some package registries (PyTorch, corporate PyPI mirrors) return `403
Forbidden` when a package is not found, instead of `404 Not Found`. The
previous error message incorrectly suggested this was always an
authentication issue, causing confusion for users.

This PR updates the error hint to clarify that a 403 error could
indicate either missing authentication credentials OR that the package
doesn't exist on the index.

## Test Plan

- Updated existing snapshot test in `crates/uv/tests/it/edit.rs` to
reflect the new error message
- The change is purely a message improvement with no behavioral changes

## Changes

### Before

hint: An index URL (https://example.com/simple) could not be queried due
to a lack of valid authentication credentials (403 Forbidden).

### After

hint: An index URL (https://example.com/simple) returned a 403 Forbidden
error. This could indicate missing authentication credentials, or the
package may not exist on this index.


## Files Changed

- `crates/uv-resolver/src/pubgrub/report.rs` - Updated error message
- `crates/uv/tests/it/edit.rs` - Updated snapshot test expectation

---------

Co-authored-by: eun2ce <eun2ce@eun2ceui-MacBookPro.local>
Co-authored-by: konstin <konstin@mailbox.org>
2025-10-20 11:43:18 +00:00
Parham MohammadAlizadeh ed3f99a119
Add required environment marker example to hint (#16244)
## Summary
fixes issue #15938 
- show platform wheel hint with a concrete
`tool.uv.required-environments` example so users know how to configure
compatibility
- add `WheelTagHint::suggest_environment_marker` to pick a sensible
environment marker based on the available wheel tags
- update the `sync_required_environment_hint` integration snapshot to
expect the new multi-line hint

## Test Plan

cargo test --package uv --test it --
sync::sync_required_environment_hint
2025-10-20 13:08:10 +02:00
renovate[bot] 2b0407e277
Update dependency astral-sh/uv to v0.9.4 (#16363)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/uv](https://redirect.github.com/astral-sh/uv) | uses-with |
patch | `0.9.2` -> `0.9.4` |

---

### Release Notes

<details>
<summary>astral-sh/uv (astral-sh/uv)</summary>

###
[`v0.9.4`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#094)

[Compare
Source](https://redirect.github.com/astral-sh/uv/compare/0.9.3...0.9.4)

Released on 2025-10-17.

##### Enhancements

- Add CUDA 13.0 support
([#&#8203;16321](https://redirect.github.com/astral-sh/uv/pull/16321))
- Add auto-detection for Intel GPU on Windows
([#&#8203;16280](https://redirect.github.com/astral-sh/uv/pull/16280))
- Implement display of RFC 9457 HTTP error contexts
([#&#8203;16199](https://redirect.github.com/astral-sh/uv/pull/16199))

##### Bug fixes

- Avoid obfuscating pyx tokens in `uv auth token` output
([#&#8203;16345](https://redirect.github.com/astral-sh/uv/pull/16345))

###
[`v0.9.3`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#093)

[Compare
Source](https://redirect.github.com/astral-sh/uv/compare/0.9.2...0.9.3)

Released on 2025-10-14.

##### Python

- Add CPython 3.15.0a1
- Add CPython 3.13.9

##### Enhancements

- Obfuscate secret token values in logs
([#&#8203;16164](https://redirect.github.com/astral-sh/uv/pull/16164))

##### Bug fixes

- Fix workspace with relative pathing
([#&#8203;16296](https://redirect.github.com/astral-sh/uv/pull/16296))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNDMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE0My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-10-20 10:33:57 +02:00
renovate[bot] 1bdd85b4e8
Update Rust crate globset to v0.4.17 (#16365)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[globset](https://redirect.github.com/BurntSushi/ripgrep/tree/master/crates/globset)
([source](https://redirect.github.com/BurntSushi/ripgrep/tree/HEAD/crates/globset))
| workspace.dependencies | patch | `0.4.16` -> `0.4.17` |

---

### Release Notes

<details>
<summary>BurntSushi/ripgrep (globset)</summary>

###
[`v0.4.17`](https://redirect.github.com/BurntSushi/ripgrep/compare/globset-0.4.16...globset-0.4.17)

[Compare
Source](https://redirect.github.com/BurntSushi/ripgrep/compare/globset-0.4.16...globset-0.4.17)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNDMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE0My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-10-20 10:32:48 +02:00
renovate[bot] 152461bc43
Update Rust crate ignore to v0.4.24 (#16367)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[ignore](https://redirect.github.com/BurntSushi/ripgrep/tree/master/crates/ignore)
([source](https://redirect.github.com/BurntSushi/ripgrep/tree/HEAD/crates/ignore))
| workspace.dependencies | patch | `0.4.23` -> `0.4.24` |

---

### Release Notes

<details>
<summary>BurntSushi/ripgrep (ignore)</summary>

###
[`v0.4.24`](https://redirect.github.com/BurntSushi/ripgrep/compare/ignore-0.4.23...ignore-0.4.24)

[Compare
Source](https://redirect.github.com/BurntSushi/ripgrep/compare/ignore-0.4.23...ignore-0.4.24)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNDMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE0My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-10-20 10:32:02 +02:00
renovate[bot] c494c2c0b0
Update Rust crate goblin to v0.10.3 (#16366) 2025-10-20 01:32:05 +00:00
konsti 2428a1664e
Document metadata consistency expectation (#15683)
An opinionated write-up on why Python packaging needs metadata
consistency, and that we need to extend metadata to accommodate ML and
scientific users.

I didn't add a paragraph related to CUDA or accelerators in general and
wheel variants, as this is currently support neither by wheel tags nor
by PEP 508 markers, so it's not a strict metadata consistency concern,
plus this would get outdated quickly as wheel variants progress.
2025-10-19 14:29:47 +02:00
Björn Dahlgren 57f56467d9
Fix typo in MissingTopLevel warning (#16351)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

<!-- What's the purpose of the change? What does it do, and why? -->
The warning shown when `egg-info` lacks `top_level.txt` incorrectly
warns about missing `top-level.txt`

ee2649feaa/crates/uv-install-wheel/src/uninstall.rs (L179-L188)

ee2649feaa/crates/uv/src/commands/pip/operations.rs (L687-L693)

The non fatal warning with incorrect filename was introduced in
https://github.com/astral-sh/uv/pull/6881 which changed previous fatal
error https://github.com/astral-sh/uv/issues/6872 with correct
`top_level.txt` output.

## Test Plan

<!-- How was it tested? -->
Updated unit test to reflect change in warning
2025-10-19 11:32:50 +02:00
Zanie Blue 88f519a3bf
Drop annotations from DockerHub uv images (#16356) 2025-10-18 14:58:06 -05:00
Zanie Blue 70cfc4020a
Drop publish of extended images to DockerHub temporarily (#16355)
To workaround https://github.com/astral-sh/uv/issues/16350
2025-10-18 14:47:48 -05:00
Zanie Blue ee2649feaa
Bump version to 0.9.4 (#16347) 2025-10-17 16:02:02 -05:00
David Peter b50c1be100
Only add actual schema in schemastore PRs (#16346)
## Summary

Last time I ran the `update_schemastore.py` script in ty, due to what I
assume was a `npm` version mismatch, the `package-lock.json` file was
updated while running `npm install` in the `schemastore`. Due to the use
of `git commit -a`, it was accidentally included in the commit for the
semi-automated schemastore PR. The solution here is to only add the
actual file that we want to commit.

Same as https://github.com/astral-sh/ty/pull/1391

## Test Plan

I did a dry-run of this script (by commenting out the final `push`) and
verified that the commit did include the schema, but not the updated
`package-lock.json` file.
2025-10-17 19:35:53 +00:00
Zanie Blue 7b3a9c2859
Avoid obfuscating pyx tokens in `uv auth token` output (#16345) 2025-10-17 19:19:05 +00:00
Yu, Guangye de9f299b80
Add auto-detection for Intel GPU on Windows (#16280)
This PR enables `--torch-backend=auto` to automatically detect Intel
GPUs. It follows up on
[#14386](https://github.com/astral-sh/uv/pull/14386).
On Windows, detection is implemented by querying the
`Win32_VideoController` class via the [WMI
crate](https://github.com/ohadravid/wmi-rs/tree/v0.16.0).

Currently, Intel GPUs (XPU) do not depend on specific driver or toolkit
versions to determine which PyTorch wheel to use.
2025-10-16 16:56:07 -04:00
Mark Dodgson c12e8bb343
Implement RFC9457 compliant messaging (#16199)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

HTTP1.1 [RFC 9112 -
HTTP/1.1](https://www.rfc-editor.org/rfc/rfc9112.html#name-status-line)
section 4 defines the response status code to optionally include a text
description (human readable) of the reason for the status code.

[RFC9113 - HTTP/2](https://www.rfc-editor.org/rfc/rfc9113) is the HTTP2
protocol standard and the response status only considers the [status
code](https://www.rfc-editor.org/rfc/rfc9113#name-response-pseudo-header-fiel)
and not the reason phrase, and as such important information can be lost
in helping the client determine a route cause of a failure.

As per discussion on this
[PR](https://github.com/astral-sh/uv/pull/15979) the current feeling is
that implementing the RFC9457 standard might be the preferred route.
This PR makes those changes to aid the discussion which has also been
moved to the [PEP
board](https://discuss.python.org/t/block-download-of-components-when-violating-policy/104021/1)

## Test Plan

Pulling components that violate our policy over HTTP2 and without any
RFC9457 implementation the following message is presented to the user:
<img width="1482" height="104" alt="image"
src="https://github.com/user-attachments/assets/0afcd0d8-ca67-4f94-a6c2-131e3b6d8dcc"
/>


With the RFC9457 standard implemented, below you can see the advantage
in the extra context as to why the component has been blocked:
<img width="2171" height="127" alt="image"
src="https://github.com/user-attachments/assets/25bb5465-955d-4a76-9f30-5477fc2c866f"
/>

---------

Co-authored-by: konstin <konstin@mailbox.org>
2025-10-16 19:53:49 +00:00
Zanie Blue 0a2b160400
Migrate from deprecated `macos-13` runner to `macos-15-intel` (#16316) 2025-10-16 09:07:18 -05:00
Charlie Marsh bf81a5bf0c
Add CUDA 13.0 support (#16321)
## Summary

Closes https://github.com/astral-sh/uv/issues/16319.
2025-10-15 15:10:08 -04:00
konsti 766bd951cb
Use `uv_build` in `make_project` tests (#16298)
Skip downloading and running setuptools.
2025-10-15 20:45:32 +02:00
konsti 52cc3c8b94
Add missing `UV_TEST_NO_HTTP_RETRY_DELAY` check and better logging (#16313)
The `install_http_retries` test goes from 15s to 0.3s. Additionally, we
log the retry delay.
2025-10-15 20:45:21 +02:00
Zanie Blue 83635a6c45
Update changelog to escape GitHub bad behavior (#16315) 2025-10-15 08:45:05 -05:00
Zanie Blue 9db7d38cf7
Bump version to 0.9.3 (#16305) 2025-10-14 18:19:49 -05:00
Zanie Blue d1413a60d8
Add CPython 3.15.0a1 and 3.13.9 (#16304) 2025-10-14 18:05:44 -05:00
Mark Dodgson b151e0ea3d
Fix workspace with relative pathing (#16296)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

Fixes #16285 

## Test Plan

<!-- How was it tested? -->
2025-10-14 19:15:19 +02:00
Geoffrey Thomas 8eada1685c
Fix comments on python_no_transparent_upgrade_with_venv_patch_specification (#16294)
I think this was originally intended to behave as the comments
specified, but the behavior changed in discussions in #13312 somewhere.
2025-10-14 07:32:47 -05:00
renovate[bot] f9fbf41f69
Update Rust crate ref-cast to v1.0.25 (#16272) 2025-10-13 10:59:44 -04:00
renovate[bot] 45e8b38bb6
Update Rust crate thiserror to v2.0.17 (#16276) 2025-10-13 10:59:09 -04:00
renovate[bot] ae273f35d3
Update Rust crate serde to v1.0.228 (#16275) 2025-10-13 10:59:01 -04:00
Zanie Blue 15829bb30a
Obfuscate Bearer Token values in logs (#16164)
Sometimes a credential's `Debug` formatted value appears in tracing logs
- make sure the credential doesn't appear there.

## Test plan

Added a test case + ran
```
uv pip install --default-index $PYX_API_URL/$SOME_INDEX $SOME_PACKAGE -vv
```
With an authenticated uv client and confirmed the tokens are obfuscated.

---------

Co-authored-by: Zsolt Dollenstein <zsol.zsol@gmail.com>
2025-10-13 08:28:20 -05:00
renovate[bot] 01d43382be
Update Rust crate rkyv to v0.8.12 (#16274) 2025-10-13 02:57:25 +00:00
renovate[bot] e3690e702f
Update Rust crate regex-automata to v0.4.12 (#16273) 2025-10-13 02:55:24 +00:00
renovate[bot] 15f1dc6269
Update Rust crate petgraph to v0.8.3 (#16270) 2025-10-13 02:42:49 +00:00
renovate[bot] 3837b92cc1
Update Rust crate owo-colors to v4.2.3 (#16269) 2025-10-13 02:40:07 +00:00
renovate[bot] dd89bdaab0
Update Rust crate quote to v1.0.41 (#16271) 2025-10-13 02:36:45 +00:00
renovate[bot] cd859ccd17
Update Rust crate memchr to v2.7.6 (#16268) 2025-10-12 22:21:43 -04:00
renovate[bot] c741e4bfb5
Update Rust crate fs-err to v3.1.3 (#16265) 2025-10-12 22:21:23 -04:00
renovate[bot] 7d5795e2a5
Update Rust crate flate2 to v1.1.4 (#16264) 2025-10-12 22:21:17 -04:00