Commit Graph

5625 Commits

Author SHA1 Message Date
Zanie Blue a9f35523c9
Add CVE disclosure to security policy (#11037) 2025-01-28 14:36:53 -06:00
Charlie Marsh f1840c77b6
Guard against concurrent cache writes on Windows (#11007)
## Summary

On Windows, we have a lot of issues with atomic replacement and such.
There are a bunch of different failure modes, but they generally
involve: trying to persist a fail to a path at which the file already
exists, trying to replace or remove a file while someone else is reading
it, etc.

This PR adds locks to all of the relevant database paths. We already use
these advisory locks when building source distributions; now we use them
when unzipping wheels, storing metadata, etc.

Closes #11002.

## Test Plan

I ran the following script:

```shell
# Define the cache directory path
$cacheDir = "C:\Users\crmar\workspace\uv\cache"

# Clear the cache directory if it exists
if (Test-Path $cacheDir) {
    Remove-Item -Recurse -Force $cacheDir
}

# Create the cache directory again
New-Item -ItemType Directory -Force -Path $cacheDir

# Define the command to run with --cache-dir flag
$command = {
    param ($venvPath)

    # Create a virtual environment in the specified path with --python
    uv venv $venvPath

    # Run the pip install command with --cache-dir flag
    C:\Users\crmar\workspace\uv\target\profiling\uv.exe pip install flask==1.0.4 --no-binary flask --cache-dir C:\Users\crmar\workspace\uv\cache -v --python $venvPath
}

# Define the paths for the different virtual environments
$venv1 = "C:\Users\crmar\workspace\uv\venv1"
$venv2 = "C:\Users\crmar\workspace\uv\venv2"
$venv3 = "C:\Users\crmar\workspace\uv\venv3"
$venv4 = "C:\Users\crmar\workspace\uv\venv4"
$venv5 = "C:\Users\crmar\workspace\uv\venv5"

# Start the command in parallel five times using Start-Job, each with a different venv
$job1 = Start-Job -ScriptBlock $command -ArgumentList $venv1
$job2 = Start-Job -ScriptBlock $command -ArgumentList $venv2
$job3 = Start-Job -ScriptBlock $command -ArgumentList $venv3
$job4 = Start-Job -ScriptBlock $command -ArgumentList $venv4
$job5 = Start-Job -ScriptBlock $command -ArgumentList $venv5

# Wait for all jobs to complete
$jobs = @($job1, $job2, $job3, $job4, $job5)
$jobs | ForEach-Object { Wait-Job $_ }

# Retrieve the results (optional)
$jobs | ForEach-Object { Receive-Job -Job $_ }

# Clean up the jobs
$jobs | ForEach-Object { Remove-Job -Job $_ }
```

And ensured it succeeded in five straight invocations (whereas on
`main`, it consistently fails with a variety of different traces).
2025-01-28 15:33:49 -05:00
Zanie Blue 321f8ccf45
Add SECURITY policy (#11035)
Closes https://github.com/astral-sh/uv/issues/11020
2025-01-28 14:06:53 -06:00
Zanie Blue fe6126a92b
Improve SIGINT handling in `uv run` (#11009)
There should be two functional changes here:

- If we receive SIGINT twice, forward it to the child process
- If the `uv run` child process changes its PGID, then forward SIGINT

Previously, we never forwarded SIGINT to a child process. Instead, we
relied on shell to do so.

On Windows, we still do nothing but eat the Ctrl-C events we receive.
I cannot see an easy way to send them to the child.

The motivation for these changes should be explained in the comments.

Closes https://github.com/astral-sh/uv/issues/10952 (in which Ray
changes its PGID)
Replaces the (much simpler) #10989 with a more comprehensive approach.

See https://github.com/astral-sh/uv/pull/6738#issuecomment-2315451358
for some previous context.
2025-01-28 14:00:38 -06:00
Zanie Blue e26affd27c
Fix best-interpreter lookups when there is an invalid interpreter in the PATH (#11030)
Closes https://github.com/astral-sh/uv/issues/10978

The root cause is the same as #10908 — I should have been more careful
with the original change.
2025-01-28 13:44:32 -06:00
Zanie Blue 4b8e157ba7
Add upper bound constraints to (more) test cases that use pytorch index (#11034)
Closes https://github.com/astral-sh/uv/issues/11025
2025-01-28 19:28:54 +00:00
Zanie Blue 0ae3fce599
Add test coverage for #10978 (#11029) 2025-01-28 19:15:15 +00:00
Zanie Blue 7949672cab
Add upper bounds to `lock_pytorch_cpu` torch versions (#11033)
Presumably this is a better alternative to
https://github.com/astral-sh/uv/pull/11031
2025-01-28 18:52:58 +00:00
Andrew Gallant 2c7b14da70
tests: update snapshots again (#11026)
It looks like an sdist got uploaded after-the-fact for `MarkupSafe
2.1.5` and this has changed some of our lock files.
2025-01-28 17:48:23 +00:00
Zanie Blue 06a03a285a
Set `JEMALLOC_SYS_WITH_LG_PAGE=16` in arm Docker builds (#10943)
We do this in our standard binary release pipeline, but not in our
Docker images.

See https://github.com/astral-sh/uv/issues/10942
2025-01-28 11:35:54 -06:00
Andrew Gallant 4a735461b5
tests: update snapshots (#11023)
I'm getting these updates locally, and wondering if they specific to my
local setup or if there was a recent release. So let's see what CI says.
2025-01-28 11:29:05 -06:00
Charlie Marsh 566f0d0abd
Add `Requires-Python` upper bound behavior to the docs (#10964)
## Summary

Closes https://github.com/astral-sh/uv/issues/10376.
2025-01-28 12:17:34 -05:00
Charlie Marsh 92b72c62ea
Amend `requires-python` rules in resolver documentation (#10993)
## Summary

Closes https://github.com/astral-sh/uv/issues/10967.
2025-01-28 12:17:27 -05:00
Zanie Blue a6d887a37e
Include Rust toolchain in cache in trampoline test job (#11019) 2025-01-28 14:26:07 +00:00
micolous 52870c587c
Fix incorrect error message when specifying `tool.uv.sources.(package).workspace` with other options (#11013)
## Summary

When a `pyproject.toml` `[tool.uv.sources.(package)]` section specifies
`workspace` and one or more of (`index`, `git`, `url`, `path`, `rev`,
`tag`, `branch`, `editable`), running `uv` to build or sync the package
gives the error:

```
cannot specify both `index` and `(parameter name)`
```

The error should actually say:

```
cannot specify both `workspace` and `(parameter name)`
```

## Test Plan

I ran `cargo test`, and all tests still passed.
2025-01-28 09:25:33 -05:00
Aria Desires a2db48d649
fix async windows file persist retries (#11008)
The previous two versions of the code were bugged and would always
produce None when you retried (producing a hard LostState error).
2025-01-27 18:51:36 -05:00
konsti c1a2ef12d2
Respect `--no-sources` for `uv pip install` workspace discovery (#11003) 2025-01-28 00:10:27 +01:00
Charlie Marsh bbba2c7bce
Remove unnecessary distribution clone (#11004) 2025-01-27 18:07:13 -05:00
konsti bd9607bbf9
Properly format test publish error (#11001) 2025-01-27 21:03:21 +01:00
Charlie Marsh a00f6f5d3d
Reject `--editable` flag on non-directory requirements (#10994)
## Summary

Closes https://github.com/astral-sh/uv/issues/10992.
2025-01-27 19:37:23 +00:00
Zanie Blue 71f0798536
Add a troubleshooting section and reproducible example guide (#10947)
Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
2025-01-27 13:29:23 -06:00
Cédric 315fc1792a
Update documentation for activating virtual environments in different shell (#11000)
## Add activation commands for fish shell and other alternative shells

While trying to use uv with fish shell, I encountered an issue as
`source .venv/bin/activate` didn't work. The documentation didn't
specify that fish shell requires using `source .venv/bin/activate.fish`
instead. I created issue #10986 to address this.

This PR improves the documentation by:
- Adding the correct activation command for fish shell: `source
.venv/bin/activate.fish`
- Adding the correct activation command for Nushell: `use
.venv\Scripts\activate.nu`
- Adding the correct activation command for Tcsh: `use
.venv/bin/activate.csh`

This will help users of alternative shells to properly activate their
virtual environments without encountering the same confusion I
experienced.

Fixes #10986

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-01-27 19:24:47 +00:00
konsti 3c6aee30fc
Improve publish test script resilience (#10984) 2025-01-27 20:20:33 +01:00
Charlie Marsh c88a4baaac
Update `compile_enumerate_no_versions ` snapshot (#10998)
## Summary

I think the "available versions" may not filter on `--exclude-newer`,
since it's marked as an incompatibility? In which case, this error
message can change as versions are published.
2025-01-27 14:18:15 -05:00
Charlie Marsh f1c02182b7
Reference workspaces in `--no-sources` documentation (#10995)
## Summary

See:
https://github.com/astral-sh/uv/issues/10991#issuecomment-2616543018
2025-01-27 13:33:14 -05:00
Ryan 90a4178c7a
[docs/integration/docker] add sha pinning tip (#10955)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

<!-- What's the purpose of the change? What does it do, and why? -->

As requested in https://github.com/astral-sh/uv/issues/6565, this adds a
tip discussing the ability to pin the image to a specific SHA digest and
why it may be useful.

## Test Plan

<!-- How was it tested? -->

Start serving the documentation locally

```shell
uvx --with-requirements docs/requirements.txt -- mkdocs serve -f mkdocs.public.yml
```

Then navigate to http://127.0.0.1:8000/uv/guides/integration/docker/ to
see the tool tip being rendered properly

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-01-27 18:29:23 +00:00
Zanie Blue e8d50153d0
Update name of "Build binary" job to highlight that these are the "release" binaries (#10990)
I found this confusing since we have `build binary` jobs in regular CI
2025-01-27 11:48:38 -06:00
konsti ad60f8da77
Use install action for cargo shear (#10983) 2025-01-27 18:06:17 +01:00
renovate[bot] b1706ad8be
Update Rust crate rustix to v0.38.44 (#10974) 2025-01-26 22:23:02 -05:00
renovate[bot] bcbc35c844
Update Rust crate fs-err to v3.1.0 (#10976) 2025-01-27 02:49:02 +00:00
renovate[bot] b80ba9bca7
Update pre-commit hook astral-sh/ruff-pre-commit to v0.9.3 (#10975) 2025-01-27 02:33:35 +00:00
renovate[bot] fb545130eb
Update Rust crate rkyv to v0.8.10 (#10973) 2025-01-27 02:23:24 +00:00
renovate[bot] a1ce4aac59
Update Rust crate jiff to v0.1.27 (#10972) 2025-01-26 21:21:01 -05:00
renovate[bot] f1f0730bc9
Update Rust crate insta to v1.42.1 (#10971) 2025-01-26 21:20:54 -05:00
renovate[bot] 20c0385bb3
Update Rust crate clap to v4.5.27 (#10970) 2025-01-26 21:20:47 -05:00
Charlie Marsh 86ec6c86dd
Prefer preferences with greater package versions (#10963)
## Summary

Closes https://github.com/astral-sh/uv/issues/10957.
2025-01-25 16:37:25 -05:00
Paul e8d6b330a3
tiny typo (duplicate word) (#10959)
Fix an apparent typo
2025-01-25 10:30:10 -06:00
Charlie Marsh a681905e12
Allow optional `=` for editables in `requirements.txt` (#10954)
## Summary

We allow this for all other argument flags; seems like an oversight.

Closes https://github.com/astral-sh/uv/issues/10941.
2025-01-24 21:55:51 -05:00
Zanie Blue 1ef47aa1d5
Only move the `.cargo` directory if it exists (#10938)
which it usually does... but on some runners it can be missing now?
2025-01-24 15:39:29 +00:00
Zanie Blue eeab865194
Update `riscv64` Python downloads to allow install on `riscv64gc` (#10937)
Closes https://github.com/astral-sh/uv/issues/10883
2025-01-24 09:33:29 -06:00
Zanie Blue 98e7cd00c8
Add Windows aarch64 to the release binaries (#10885)
Following test coverage from #10540 
Closes https://github.com/astral-sh/uv/issues/1141
2025-01-24 09:24:22 -06:00
konsti f645499dbd
Child exit with signal n returns 128+n (#10781) 2025-01-24 16:20:32 +01:00
Zanie Blue 0008ec69c4
Run multiple commands in ecosystem tests (#10920) 2025-01-24 09:18:21 -06:00
吴小白 57a2740d90
Allow installation of manylinux wheels on loongarch64 (#10927) 2025-01-24 14:36:03 +01:00
Zanie Blue 6e4845fffb
Add documentation for `uv add -r` (#10926)
Closes https://github.com/astral-sh/uv/issues/10924
2025-01-23 21:34:50 -06:00
Zanie Blue 42fae925c4
Bump version to 0.5.24 (#10922) 2025-01-23 17:26:59 -06:00
Zanie Blue 9a2d5fd358
Add ecosystem test case for `pydantic/pydantic-core` (#10917) 2025-01-23 17:05:13 -06:00
Zanie Blue cbf6d5af9e
Allow fallback to Python download on non-critical discovery errors (#10908)
Closes https://github.com/astral-sh/uv/issues/10898

In #10716, I broke fallback to downloading Python versions by throwing a
different error kind.
2025-01-23 22:37:02 +00:00
Zanie Blue 2a0fa8a8ee
Add test case for automatic installs (#10913) 2025-01-23 22:21:21 +00:00
Zanie Blue 10654cb8c2
Fix render of matrix arch for system conda tests (#10914) 2025-01-23 21:31:59 +00:00