317 Commits

Author SHA1 Message Date
Zanie Blue
0dc9556adb Bump version to 0.9.21 (#17270) 2025-12-30 15:46:08 +00:00
Charlie Marsh
765a967236 Bump version to 0.9.20 (#17256)
## Summary

In #17254, I failed to bump the versions of the various internal crates,
so need to re-release.
2025-12-29 20:13:57 +00:00
konsti
e2a775d727 Use the same retry logic across uv (#17105)
We were using slightly different retry code in multiple places, this PR
unifies it.

Also fixes retry undercounting in publish if the retry middleware was
involved.

---------

Co-authored-by: Tomasz Kramkowski <tom@astral.sh>
2025-12-18 12:44:37 +00:00
konsti
a25d4f953f Fix retry counts in cached client (#17104)
Previously, we dropped the counts from the middleware layer, potentially
doing to many retries and/or reporting too few.

Not pretty but fixes the bug.
2025-12-18 10:51:00 +00:00
stringscut
9f422e7515 Fix comment typos and improve wording (#17166)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

improve code comments clarity

<!-- What's the purpose of the change? What does it do, and why? -->

## Test Plan

<!-- How was it tested? -->

Signed-off-by: stringscut <stringscut@outlook.jp>
2025-12-18 11:47:43 +01:00
konsti
9360ca7778 Refactor uv retrayble strategy to use a single code path (#17099)
Refactoring that allows uv's retryable strategy to return
`Some(Retryable::Fatal)`, also helpful for
https://github.com/astral-sh/uv/pull/16245
2025-12-18 11:10:47 +01:00
konsti
0cee76417f Bump version to 0.9.18 (#17141)
It's been a week.

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-12-16 13:32:35 +00:00
Diyor Khayrutdinov
b58f543e5e Support redirects in uv publish (#17130)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

Follow redirects for `uv publish`. Related issue:
https://github.com/astral-sh/uv/issues/17126.

## Test Plan

<!-- How was it tested? -->
Added a unit test to test the custom redirect logic.

---------

Co-authored-by: konstin <konstin@mailbox.org>
2025-12-16 09:04:28 +00:00
Tomasz Kramkowski
d20948bec2 Support creating lock files on ExFAT on MacOS (#17115)
## Summary

Fix #16859 by falling back to simply creating the lock file and then
attempting to apply permissions in cases where the temporary lockfile
cannot be renamed without overwriting (persist_noclobber) due to lack of
underlying support from the filesystem.

I've also improved the error handling.

## Test Plan

Manually on MacOS with an ExFAT partition.

~~~ bash session
$ hdiutil create -size 1g -fs ExFAT -volname EXFATDISK exfat.dmg
$ hdiutil attach exfat.dmg
$ cd /Volumes/EXFATDISK
$ uv init --bare --cache-dir build/uv/cache -v 
~~~
2025-12-15 14:05:05 +00:00
Zanie Blue
2b5d65e61d Bump version to 0.9.17 (#17058) 2025-12-09 16:36:00 -06:00
Zanie Blue
a63e5b62e3 Bump version to 0.9.16 (#17008) 2025-12-06 07:52:06 -06:00
Zanie Blue
f6ad3dcd57 Regenerate the crates.io readmes on release (#16992)
Otherwise, they're stale!
2025-12-04 19:19:36 -06:00
konsti
62bf92132b Add a 5 min default timeout for deadlocks (#16342)
When a process is running and another calls `uv cache clean` or `uv
cache prune` we currently deadlock - sometimes until the CI timeout
(https://github.com/astral-sh/setup-uv/issues/588). To avoid this, we
add a default 5 min timeout waiting for a lock. 5 min balances allowing
in-progress builds to finish, especially with larger native
dependencies, while also giving timely errors for deadlocks on (remote)
systems.

Commit 1 is a refactoring.

This branch also fixes a problem with the logging where acquired and
released resources currently mismatch:

```
DEBUG Acquired lock for `https://github.com/tqdm/tqdm`
DEBUG Using existing Git source `https://github.com/tqdm/tqdm`
DEBUG Released lock at `C:\Users\Konsti\AppData\Local\uv\cache\git-v0\locks\16bb813afef8edd2`
```
2025-12-04 14:59:04 +01:00
konsti
05fa19c440 Use explicit credentials cache instead of global static (#16768)
Fixes https://github.com/astral-sh/uv/issues/16447

Passing this around explicitly uncovers some behaviors where we pass
e.g. the credentials store to reading the lockfile. The changes in this
PR should preserve the existing behavior for now, they only make the
locations we read from more explicit.

Labeling this PR as "Enhancement" instead of "Internal" in case this
changes behavior when it shouldn't have.
2025-12-03 14:51:25 +01:00
Zanie Blue
e7af5838bb Bump version to 0.9.15 (#16942) 2025-12-02 17:48:28 -06:00
Zanie Blue
99c40f74c5 Link to the uv version in crates.io member READMEs (#16939)
Closes https://github.com/astral-sh/uv/issues/16931
2025-12-02 20:02:22 +00:00
Zsolt Dollenstein
05814f9cd5 Bump version to 0.9.14 (#16909) 2025-12-01 11:52:15 -05:00
Zsolt Dollenstein
6b00d6522c Attach subcommand to User-Agent string (#16837) 2025-12-01 10:29:54 -05:00
Zanie Blue
735b87004c Bump version to 0.9.13 (#16862) 2025-11-26 15:12:54 +00:00
Zanie Blue
17c1061676 Fix the links to uv in crates.io member READMEs (#16848) 2025-11-25 18:47:32 +00:00
Zanie Blue
0fb1233363 Bump version to 0.9.12 (#16840) 2025-11-24 23:22:12 +00:00
Zanie Blue
7b8240dca9 Generate a README for crate members too (#16812)
We skip members with existing READMEs for now.

Follows #16809 and #16811
2025-11-21 15:44:05 -06:00
Zanie Blue
1de0cbea94 Use the word "internal" in crate descriptions (#16810)
ref
https://github.com/astral-sh/uv/pull/16809#pullrequestreview-3494007588
2025-11-21 13:22:47 -06:00
Zanie Blue
563438f13d Fix documentation links for crates (#16801)
Part of https://github.com/astral-sh/uv/issues/4392

We shouldn't link to PyPI, and dropping the workspace-level
documentation link should mean that we get the auto-generated `docs.rs`
links.
2025-11-21 10:44:58 -06:00
Zanie Blue
dfe89047bb Publish to crates.io (#16770) 2025-11-20 21:26:44 +00:00
samypr100
bf99f0a195 Add support for SSL_CERT_DIR (#16473)
## Summary

Closes https://github.com/astral-sh/uv/issues/16414

Adds support for the standard
[SSL_CERT_DIR](https://docs.openssl.org/3.6/man3/SSL_CTX_load_verify_locations)
which has gained recent proper support from
[rustls-native-certs](https://github.com/rustls/rustls-native-certs/pull/187)
in v0.8.2.

In addition, this PR clarifies documentation around `SSL_CERT_FILE` and
`SSL_CERT_DIR` when used in combination with `UV_NATIVE_TLS` as
mentioned in
https://github.com/astral-sh/uv/issues/16412#issuecomment-3434927201

## Test Plan

Manually tested with custom cert chains in multiple directories and
loading them via SSL_CERT_DIR. We didn't have tests for `SSL_CERT_FILE`
or `SSL_CERT_DIR` environment variables so I added a basic one using our
own test-only certificate generation and dummy https server. I also
moved some things around for better reuse.
2025-11-16 11:48:31 -06:00
Zsolt Dollenstein
e96354a6dd Always attach linehaul data (#16705) 2025-11-12 17:10:15 +00:00
William Woodruff
ae1edef9c0 Reject ambiguously parsed URLs (#16622)
Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-11-12 16:27:57 +00:00
konsti
92c2bfcca0 Remove unnecessary DisplaySafeUrl::from (#16689)
For #16622
2025-11-11 19:12:20 +00:00
Charlie Marsh
5b517bb966 Remove Git-based dependency for tl (#16679)
## Summary

I published our own fork, since our PR had been lingering for over a
year: https://crates.io/crates/astral-tl
2025-11-11 08:41:13 -06:00
Charlie Marsh
c1c1950dce Add support for the Simple index API top-level route (#16656)
## Summary

At present, we only have support for the detail routes (e.g.,
`https://pypi.org/simple/requests`), but not the top-level index route
(e.g., `https://pypi.org/simple/`). I need this for some downstream work
so pulling it into its own PR.
2025-11-10 14:50:19 -05:00
Charlie Marsh
82aa0d0ef5 Avoid pluralizing 'retry' for single value (#16535) 2025-10-31 10:28:51 -04:00
liam
ae6607d5dc Deterministically order --find-links distributions (#16446)
Made to address this comment:
https://github.com/astral-sh/uv/pull/16103#discussion_r2437498249

This PR sorts the distributions collected by
`FlatIndexClient::read_from_directory` (used for `--find-links`) so
results are ordered deterministically by filename and index.
2025-10-26 21:53:32 -04:00
Andrei Berenda
51e8da2d1c Move parsing http retries to EnvironmentOptions (#16284)
## Summary
- Move  parsing `UV_HTTP_RETRIES` to `EnvironmentOptions`

Relates https://github.com/astral-sh/uv/issues/14720

## Test Plan

- Tests with existing tests
2025-10-21 11:14:37 +02:00
Mark Dodgson
c12e8bb343 Implement RFC9457 compliant messaging (#16199)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

HTTP1.1 [RFC 9112 -
HTTP/1.1](https://www.rfc-editor.org/rfc/rfc9112.html#name-status-line)
section 4 defines the response status code to optionally include a text
description (human readable) of the reason for the status code.

[RFC9113 - HTTP/2](https://www.rfc-editor.org/rfc/rfc9113) is the HTTP2
protocol standard and the response status only considers the [status
code](https://www.rfc-editor.org/rfc/rfc9113#name-response-pseudo-header-fiel)
and not the reason phrase, and as such important information can be lost
in helping the client determine a route cause of a failure.

As per discussion on this
[PR](https://github.com/astral-sh/uv/pull/15979) the current feeling is
that implementing the RFC9457 standard might be the preferred route.
This PR makes those changes to aid the discussion which has also been
moved to the [PEP
board](https://discuss.python.org/t/block-download-of-components-when-violating-policy/104021/1)

## Test Plan

Pulling components that violate our policy over HTTP2 and without any
RFC9457 implementation the following message is presented to the user:
<img width="1482" height="104" alt="image"
src="https://github.com/user-attachments/assets/0afcd0d8-ca67-4f94-a6c2-131e3b6d8dcc"
/>


With the RFC9457 standard implemented, below you can see the advantage
in the extra context as to why the component has been blocked:
<img width="2171" height="127" alt="image"
src="https://github.com/user-attachments/assets/25bb5465-955d-4a76-9f30-5477fc2c866f"
/>

---------

Co-authored-by: konstin <konstin@mailbox.org>
2025-10-16 19:53:49 +00:00
konsti
52cc3c8b94 Add missing UV_TEST_NO_HTTP_RETRY_DELAY check and better logging (#16313)
The `install_http_retries` test goes from 15s to 0.3s. Additionally, we
log the retry delay.
2025-10-15 20:45:21 +02:00
Andrei Berenda
a58d031157 Add UV_UPLOAD_HTTP_TIMEOUT and respect UV_HTTP_TIMEOUT in uploads (#16040)
## Summary
- Move parsing `UV_HTTP_TIMEOUT`, `UV_REQUEST_TIMEOUT` and
`HTTP_TIMEOUT` to `EnvironmentOptions`
- Add new env varialbe `UV_UPLOAD_HTTP_TIMEOUT`

Relates https://github.com/astral-sh/uv/issues/14720

## Test Plan

Tests with existing tests
2025-10-09 12:28:30 -05:00
konsti
5ee728b3e3 Retry all h2 errors (#16038)
The h2 errors, a specific type nested in reqwest errors, all look like
they shouldn't happen in regular operations and should be retried. This
covers all `io::Error`s going through h2 (i.e., only HTTP 2
connections).

Fixes https://github.com/astral-sh/uv/issues/15916
2025-10-09 13:53:14 +00:00
Ruben Arts
2e180f5c66 Add missing fields to the Cargo package manifests (#16179)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

Hey devs, great tool as always, you're doing amazing work. 

## Summary

<!-- What's the purpose of the change? What does it do, and why? -->

Adds the following fields to the `[package]` table of `Cargo.toml` files
where they were missing:
```toml
rust-version = { workspace = true }
homepage = { workspace = true }
documentation = { workspace = true }
repository = { workspace = true }
authors = { workspace = true }
license = { workspace = true }
```

Most crates already had these fields, this just aligns the rest for
consistency.

This also resolves the warnings from `cargo-deny` when using `uv` crates
as dependencies in Pixi.
## Test Plan
No tests needed, this only updates metadata.
2025-10-08 12:01:52 +02:00
Zanie Blue
4c2d9e19b0 Use EnvVars in linehaul (#15931) 2025-09-18 14:08:58 +00:00
Zanie Blue
0aa3c4e094 Propagate preview flag to client for native-auth feature (#15872)
Somehow propagation of this got dropped during a rebase, so we never
actually used the native store during resolution.

Part of https://github.com/astral-sh/uv/issues/15818
2025-09-15 10:51:44 -05:00
Charlie Marsh
b770639c91 Rename provides_extras to provides_extra (#15825)
## Summary

This is now consistent with `requires_dist` (singular).
2025-09-14 13:27:45 +00:00
konsti
4a1813f228 Extract IO errors from h2 for streaming retries of Connection Reset (#15675)
Our streaming retries were missing connection reset errors as h2 was
shadowing IO errors (https://github.com/hyperium/h2/issues/862).

**Test plan**

In one terminal:

```
cargo python uninstall 3.12 && cargo run python install 3.12 -vv
```

In another:

```
sudo tcpkill -i wlp2s0 port 443
```

Output:

```
error: Failed to install cpython-3.12.11-linux-x86_64-gnu
  Caused by: Request failed after 3 retries
  Caused by: Failed to download https://github.com/astral-sh/python-build-standalone/releases/download/20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz
  Caused by: error sending request for url (https://github.com/astral-sh/python-build-standalone/releases/download/20250902/cpython-3.12.11%2B20250902-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz)
  Caused by: client error (SendRequest)
  Caused by: connection error
  Caused by: connection reset
```

I don't know how to test that from inside Rust.

Fix #14171 (again, hopefully)
2025-09-04 14:45:00 +02:00
Charlie Marsh
4e48d759c4 Add zstandard support for wheels (#15645)
## Summary

This PR allows pyx to send down hashes for zstandard-compressed
tarballs. If the hash is present, then the file is assumed to be present
at `${wheel_url}.tar.zst`, similar in design to PEP 658
`${wheel_metadata}.metadata` files. The intent here is that the index
must include the wheel (to support all clients and support
random-access), but can optionally include a zstandard-compressed
version alongside it.
2025-09-03 01:38:31 +00:00
Charlie Marsh
b57ad179b6 Allow registries to pre-provide core metadata (#15644)
## Summary

This PR adds support for the `application/vnd.pyx.simple.v1` content
type, similar to `application/vnd.pypi.simple.v1` with the exception
that it can also include core metadata for package-versions directly.
2025-09-03 00:56:29 +00:00
Charlie Marsh
f88aaa8740 Add pyx support to uv auth commands (#15636)
## Summary

This PR adds support for pyx to `uv auth login`, `uv auth logout`, and
`uv auth token`. These are generic uv commands that can be used to store
credentials for arbitrary indexes and other URLs, but we include a
fast-path for pyx that initiates the appropriate login or logout flow.
2025-09-02 18:18:09 -04:00
Zanie Blue
709e0ba238 Remove the native system store from the keyring providers (#15612)
We're not sure what the best way to expose the native store to users is
yet and it's a bit weird that you can use this in the `uv auth` commands
but can't use any of the other keyring provider options. The simplest
path forward is to just not expose it to users as a keyring provider,
and instead frame it as a preview alternative to the plaintext uv
credentials store. We can revisit the best way to expose configuration
before stabilization.

Note this pull request retains the _internal_ keyring provider
implementation — we can refactor it out later but I wanted to avoid a
bunch of churn here.
2025-09-02 13:16:52 -05:00
Zanie Blue
4ad5ae5e6f Add preview warnings to native-keyring usage (#15555)
The refactor here was all done by Claude Code.
2025-09-02 13:16:52 -05:00
Zanie Blue
460ea6e9eb Add uv auth commands (login, logout, and token) (#15539)
Picks up the work from

- #14559
- https://github.com/astral-sh/uv/pull/14896

There are some high-level changes from those pull requests

1. We do not stash seen credentials in the keyring automatically
2. We use `auth login` and `auth logout` (for future consistency)
3. We add a `token` command for showing the credential that will be used

As well as many smaller changes to API, messaging, testing, etc.

---------

Co-authored-by: John Mumm <jtfmumm@gmail.com>
2025-09-02 13:16:52 -05:00
konsti
d5bcc0535a Add test case for status code retries (#15617)
When migrating from the `reqwest_retry` crate, we want to ensure that
the status codes we retry stay the same. This also helps us to
intentionally migrate to a different list later, by enumerating the list
of status codes that are retried.
2025-09-02 15:41:54 +02:00