mirror of
https://github.com/astral-sh/uv
synced 2026-01-23 14:30:14 -05:00
## Summary This ensures that (like Cargo) we don't suffer from https://github.com/advisories/GHSA-r5w3-xm58-jv6j, by way of checking known hosts when fetching via `libgit2`. The implementation is taken from Cargo itself, modified to remove all configuration, since we don't yet support configuration for known hosts, etc. Closes #285.