mirror of
https://github.com/astral-sh/uv
synced 2026-01-23 22:40:10 -05:00
7f1eaf48c1
## Summary uv will now reject ZIP files that meet any of the following conditions: - Multiple local header entries exist for the same file with different contents. - A local header entry exists for a file that isn't included in the end-of-central directory record. - An entry exists in the end-of-central directory record that does not have a corresponding local header. - The ZIP file contains contents after the first end-of-central directory record. - The CRC32 doesn't match between the local file header and the end-of-central directory record. - The compressed size doesn't match between the local file header and the end-of-central directory record. - The uncompressed size doesn't match between the local file header and the end-of-central directory record. - The reported central directory offset (in the end-of-central-directory header) does not match the actual offset. - The reported ZIP64 end of central directory locator offset does not match the actual offset. We also validate the above for files with data descriptors, which we previously ignored. Wheels from the most recent releases of the top 15,000 packages on PyPI have been confirmed to pass these checks, and PyPI will also reject ZIPs under many of the same conditions (at upload time) in the future. In rare cases, this validation can be disabled by setting `UV_INSECURE_NO_ZIP_VALIDATION=1`. Any validations should be reported to the uv issue tracker and to the upstream package maintainer.
324 lines
13 KiB
TOML
324 lines
13 KiB
TOML
[workspace]
|
|
members = ["crates/*"]
|
|
exclude = [
|
|
"scripts",
|
|
# Needs nightly
|
|
"crates/uv-trampoline",
|
|
# Only used to pull in features, allocators, etc. — we specifically don't want them
|
|
# to be part of a workspace-wide cargo check, cargo clippy, etc.
|
|
"crates/uv-performance-memory-allocator",
|
|
]
|
|
resolver = "2"
|
|
|
|
[workspace.package]
|
|
edition = "2024"
|
|
rust-version = "1.86"
|
|
homepage = "https://pypi.org/project/uv/"
|
|
documentation = "https://pypi.org/project/uv/"
|
|
repository = "https://github.com/astral-sh/uv"
|
|
authors = ["uv"]
|
|
license = "MIT OR Apache-2.0"
|
|
|
|
[workspace.dependencies]
|
|
uv-auth = { path = "crates/uv-auth" }
|
|
uv-build-backend = { path = "crates/uv-build-backend" }
|
|
uv-build-frontend = { path = "crates/uv-build-frontend" }
|
|
uv-cache = { path = "crates/uv-cache" }
|
|
uv-cache-info = { path = "crates/uv-cache-info" }
|
|
uv-cache-key = { path = "crates/uv-cache-key" }
|
|
uv-cli = { path = "crates/uv-cli" }
|
|
uv-client = { path = "crates/uv-client" }
|
|
uv-configuration = { path = "crates/uv-configuration" }
|
|
uv-console = { path = "crates/uv-console" }
|
|
uv-dirs = { path = "crates/uv-dirs" }
|
|
uv-dispatch = { path = "crates/uv-dispatch" }
|
|
uv-distribution = { path = "crates/uv-distribution" }
|
|
uv-distribution-filename = { path = "crates/uv-distribution-filename" }
|
|
uv-distribution-types = { path = "crates/uv-distribution-types" }
|
|
uv-extract = { path = "crates/uv-extract" }
|
|
uv-fs = { path = "crates/uv-fs", features = ["serde", "tokio"] }
|
|
uv-git = { path = "crates/uv-git" }
|
|
uv-git-types = { path = "crates/uv-git-types" }
|
|
uv-globfilter = { path = "crates/uv-globfilter" }
|
|
uv-install-wheel = { path = "crates/uv-install-wheel", default-features = false }
|
|
uv-installer = { path = "crates/uv-installer" }
|
|
uv-macros = { path = "crates/uv-macros" }
|
|
uv-metadata = { path = "crates/uv-metadata" }
|
|
uv-normalize = { path = "crates/uv-normalize" }
|
|
uv-once-map = { path = "crates/uv-once-map" }
|
|
uv-options-metadata = { path = "crates/uv-options-metadata" }
|
|
uv-pep440 = { path = "crates/uv-pep440", features = ["tracing", "rkyv", "version-ranges"] }
|
|
uv-pep508 = { path = "crates/uv-pep508", features = ["non-pep508-extensions"] }
|
|
uv-platform = { path = "crates/uv-platform" }
|
|
uv-platform-tags = { path = "crates/uv-platform-tags" }
|
|
uv-publish = { path = "crates/uv-publish" }
|
|
uv-pypi-types = { path = "crates/uv-pypi-types" }
|
|
uv-python = { path = "crates/uv-python" }
|
|
uv-redacted = { path = "crates/uv-redacted" }
|
|
uv-requirements = { path = "crates/uv-requirements" }
|
|
uv-requirements-txt = { path = "crates/uv-requirements-txt" }
|
|
uv-resolver = { path = "crates/uv-resolver" }
|
|
uv-scripts = { path = "crates/uv-scripts" }
|
|
uv-settings = { path = "crates/uv-settings" }
|
|
uv-shell = { path = "crates/uv-shell" }
|
|
uv-small-str = { path = "crates/uv-small-str" }
|
|
uv-state = { path = "crates/uv-state" }
|
|
uv-static = { path = "crates/uv-static" }
|
|
uv-tool = { path = "crates/uv-tool" }
|
|
uv-torch = { path = "crates/uv-torch" }
|
|
uv-trampoline-builder = { path = "crates/uv-trampoline-builder" }
|
|
uv-types = { path = "crates/uv-types" }
|
|
uv-version = { path = "crates/uv-version" }
|
|
uv-virtualenv = { path = "crates/uv-virtualenv" }
|
|
uv-warnings = { path = "crates/uv-warnings" }
|
|
uv-workspace = { path = "crates/uv-workspace" }
|
|
|
|
anstream = { version = "0.6.15" }
|
|
anyhow = { version = "1.0.89" }
|
|
arcstr = { version = "1.2.0" }
|
|
arrayvec = { version = "0.7.6" }
|
|
astral-tokio-tar = { version = "0.5.2" }
|
|
async-channel = { version = "2.3.1" }
|
|
async-compression = { version = "0.4.12", features = ["bzip2", "gzip", "xz", "zstd"] }
|
|
async-trait = { version = "0.1.82" }
|
|
async_http_range_reader = { version = "0.9.1" }
|
|
async_zip = { git = "https://github.com/astral-sh/rs-async-zip", rev = "285e48742b74ab109887d62e1ae79e7c15fd4878", features = ["bzip2", "deflate", "lzma", "tokio", "xz", "zstd"] }
|
|
axoupdater = { version = "0.9.0", default-features = false }
|
|
backon = { version = "1.3.0" }
|
|
base64 = { version = "0.22.1" }
|
|
bitflags = { version = "2.6.0" }
|
|
blake2 = { version = "0.10.6" }
|
|
boxcar = { version = "0.2.5" }
|
|
bytecheck = { version = "0.8.0" }
|
|
cargo-util = { version = "0.2.14" }
|
|
clap = { version = "4.5.17", features = ["derive", "env", "string", "wrap_help"] }
|
|
clap_complete_command = { version = "0.6.1" }
|
|
configparser = { version = "3.1.0" }
|
|
console = { version = "0.16.0", default-features = false, features = ["std"] }
|
|
csv = { version = "1.3.0" }
|
|
ctrlc = { version = "3.4.5" }
|
|
dashmap = { version = "6.1.0" }
|
|
data-encoding = { version = "2.6.0" }
|
|
dotenvy = { version = "0.15.7" }
|
|
dunce = { version = "1.0.5" }
|
|
either = { version = "1.13.0" }
|
|
encoding_rs_io = { version = "0.1.7" }
|
|
etcetera = { version = "0.10.0" }
|
|
flate2 = { version = "1.0.33", default-features = false, features = ["zlib-rs"] }
|
|
fs-err = { version = "3.0.0", features = ["tokio"] }
|
|
fs2 = { version = "0.4.3" }
|
|
futures = { version = "0.3.30" }
|
|
glob = { version = "0.3.1" }
|
|
globset = { version = "0.4.15" }
|
|
globwalk = { version = "0.9.1" }
|
|
goblin = { version = "0.10.0", default-features = false, features = ["std", "elf32", "elf64", "endian_fd"] }
|
|
h2 = { version = "0.4.7" }
|
|
hashbrown = { version = "0.15.1" }
|
|
hex = { version = "0.4.3" }
|
|
home = { version = "0.5.9" }
|
|
html-escape = { version = "0.2.13" }
|
|
http = { version = "1.1.0" }
|
|
indexmap = { version = "2.5.0" }
|
|
indicatif = { version = "0.18.0" }
|
|
indoc = { version = "2.0.5" }
|
|
itertools = { version = "0.14.0" }
|
|
jiff = { version = "0.2.0", features = ["serde"] }
|
|
junction = { version = "1.2.0" }
|
|
mailparse = { version = "0.16.0" }
|
|
md-5 = { version = "0.10.6" }
|
|
memchr = { version = "2.7.4" }
|
|
miette = { version = "7.2.0", features = ["fancy-no-backtrace"] }
|
|
nanoid = { version = "0.4.0" }
|
|
nix = { version = "0.30.0", features = ["signal"] }
|
|
once_cell = { version = "1.20.2" }
|
|
owo-colors = { version = "4.1.0" }
|
|
path-slash = { version = "0.2.1" }
|
|
pathdiff = { version = "0.2.1" }
|
|
percent-encoding = { version = "2.3.1" }
|
|
petgraph = { version = "0.8.0" }
|
|
proc-macro2 = { version = "1.0.86" }
|
|
procfs = { version = "0.17.0", default-features = false, features = ["flate2"] }
|
|
pubgrub = { git = "https://github.com/astral-sh/pubgrub", rev = "06ec5a5f59ffaeb6cf5079c6cb184467da06c9db" }
|
|
quote = { version = "1.0.37" }
|
|
rayon = { version = "1.10.0" }
|
|
ref-cast = { version = "1.0.24" }
|
|
reflink-copy = { version = "0.1.19" }
|
|
regex = { version = "1.10.6" }
|
|
regex-automata = { version = "0.4.8", default-features = false, features = ["dfa-build", "dfa-search", "perf", "std", "syntax"] }
|
|
reqwest = { version = "0.12.22", default-features = false, features = ["json", "gzip", "deflate", "zstd", "stream", "rustls-tls", "rustls-tls-native-roots", "socks", "multipart", "http2", "blocking"] }
|
|
reqwest-middleware = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "ad8b9d332d1773fde8b4cd008486de5973e0a3f8", features = ["multipart"] }
|
|
reqwest-retry = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "ad8b9d332d1773fde8b4cd008486de5973e0a3f8" }
|
|
rkyv = { version = "0.8.8", features = ["bytecheck"] }
|
|
rmp-serde = { version = "1.3.0" }
|
|
rust-netrc = { version = "0.1.2" }
|
|
rustc-hash = { version = "2.0.0" }
|
|
rustix = { version = "1.0.0", default-features = false, features = ["fs", "std"] }
|
|
same-file = { version = "1.0.6" }
|
|
schemars = { version = "1.0.0", features = ["url2"] }
|
|
seahash = { version = "4.1.0" }
|
|
self-replace = { version = "1.5.0" }
|
|
serde = { version = "1.0.210", features = ["derive", "rc"] }
|
|
serde-untagged = { version = "0.1.6" }
|
|
serde_json = { version = "1.0.128" }
|
|
sha2 = { version = "0.10.8" }
|
|
smallvec = { version = "1.13.2" }
|
|
spdx = { version = "0.10.6" }
|
|
syn = { version = "2.0.77" }
|
|
sys-info = { version = "0.9.1" }
|
|
tar = { version = "0.4.43" }
|
|
target-lexicon = { version = "0.13.0" }
|
|
tempfile = { version = "3.14.0" }
|
|
textwrap = { version = "0.16.1" }
|
|
thiserror = { version = "2.0.0" }
|
|
tl = { git = "https://github.com/astral-sh/tl.git", rev = "6e25b2ee2513d75385101a8ff9f591ef51f314ec" }
|
|
tokio = { version = "1.40.0", features = ["fs", "io-util", "macros", "process", "rt", "signal", "sync"] }
|
|
tokio-stream = { version = "0.1.16" }
|
|
tokio-util = { version = "0.7.12", features = ["compat", "io"] }
|
|
toml = { version = "0.9.2", features = ["fast_hash"] }
|
|
toml_edit = { version = "0.23.2", features = ["serde"] }
|
|
tracing = { version = "0.1.40" }
|
|
tracing-durations-export = { version = "0.3.0", features = ["plot"] }
|
|
tracing-subscriber = { version = "0.3.18", features = ["env-filter", "json", "registry"] }
|
|
tracing-test = { version = "0.2.5" }
|
|
tracing-tree = { version = "0.4.0" }
|
|
unicode-width = { version = "0.2.0" }
|
|
unscanny = { version = "0.1.0" }
|
|
url = { version = "2.5.2", features = ["serde"] }
|
|
version-ranges = { git = "https://github.com/astral-sh/pubgrub", rev = "06ec5a5f59ffaeb6cf5079c6cb184467da06c9db" }
|
|
walkdir = { version = "2.5.0" }
|
|
which = { version = "8.0.0", features = ["regex"] }
|
|
windows = { version = "0.59.0", features = ["Win32_Globalization", "Win32_System_Console", "Win32_System_Kernel", "Win32_System_Diagnostics_Debug", "Win32_Storage_FileSystem"] }
|
|
windows-core = { version = "0.59.0" }
|
|
windows-registry = { version = "0.5.0" }
|
|
windows-result = { version = "0.3.0" }
|
|
windows-sys = { version = "0.59.0", features = ["Win32_Foundation", "Win32_Security", "Win32_Storage_FileSystem", "Win32_System_Ioctl", "Win32_System_IO", "Win32_System_Registry"] }
|
|
wiremock = { version = "0.6.4" }
|
|
xz2 = { version = "0.1.7" }
|
|
zip = { version = "2.2.3", default-features = false, features = ["deflate", "zstd", "bzip2", "lzma", "xz"] }
|
|
|
|
# dev-dependencies
|
|
assert_cmd = { version = "2.0.16" }
|
|
assert_fs = { version = "1.1.2" }
|
|
byteorder = { version = "1.5.0" }
|
|
filetime = { version = "0.2.25" }
|
|
http-body-util = { version = "0.1.2" }
|
|
hyper = { version = "1.4.1", features = ["server", "http1"] }
|
|
hyper-util = { version = "0.1.8", features = ["tokio"] }
|
|
ignore = { version = "0.4.23" }
|
|
insta = { version = "1.40.0", features = ["json", "filters", "redactions"] }
|
|
predicates = { version = "3.1.2" }
|
|
similar = { version = "2.6.0" }
|
|
temp-env = { version = "0.3.6" }
|
|
test-case = { version = "3.3.1" }
|
|
test-log = { version = "0.2.16", features = ["trace"], default-features = false }
|
|
whoami = { version = "1.6.0" }
|
|
|
|
[workspace.metadata.cargo-shear]
|
|
ignored = ["flate2", "xz2", "h2"]
|
|
|
|
[workspace.lints.rust]
|
|
unsafe_code = "warn"
|
|
unreachable_pub = "warn"
|
|
|
|
[workspace.lints.clippy]
|
|
pedantic = { level = "warn", priority = -2 }
|
|
# Allowed pedantic lints
|
|
char_lit_as_u8 = "allow"
|
|
collapsible_else_if = "allow"
|
|
collapsible_if = "allow"
|
|
implicit_hasher = "allow"
|
|
map_unwrap_or = "allow"
|
|
match_same_arms = "allow"
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|
|
module_name_repetitions = "allow"
|
|
must_use_candidate = "allow"
|
|
similar_names = "allow"
|
|
struct_excessive_bools = "allow"
|
|
too_many_arguments = "allow"
|
|
too_many_lines = "allow"
|
|
used_underscore_binding = "allow"
|
|
# Disallowed restriction lints
|
|
print_stdout = "warn"
|
|
print_stderr = "warn"
|
|
dbg_macro = "warn"
|
|
empty_drop = "warn"
|
|
empty_structs_with_brackets = "warn"
|
|
exit = "warn"
|
|
get_unwrap = "warn"
|
|
rc_buffer = "warn"
|
|
rc_mutex = "warn"
|
|
rest_pat_in_fully_bound_structs = "warn"
|
|
if_not_else = "allow"
|
|
use_self = "warn"
|
|
|
|
# Diagnostics are not actionable: Enable once https://github.com/rust-lang/rust-clippy/issues/13774 is resolved.
|
|
large_stack_arrays = "allow"
|
|
|
|
[profile.release]
|
|
strip = true
|
|
lto = "fat"
|
|
|
|
# This profile is meant to mimic the `release` profile as closely as
|
|
# possible, but using settings that are more beneficial for iterative
|
|
# development. That is, the `release` profile is intended for actually
|
|
# building the release, where as `profiling` is meant for building `uv`
|
|
# for running benchmarks.
|
|
#
|
|
# The main differences here are to avoid stripping debug information
|
|
# and disabling lto. This does result in a mismatch between our release
|
|
# configuration and our benchmarking configuration, which is unfortunate.
|
|
# But compile times with `lto = true` are completely untenable:
|
|
#
|
|
# $ cargo b --profile profiling -p uv
|
|
# Compiling uv-cli v0.0.1 (/home/andrew/astral/uv/crates/uv-cli)
|
|
# Compiling uv v0.2.34 (/home/andrew/astral/uv/crates/uv)
|
|
# Finished `profiling` profile [optimized + debuginfo] target(s) in 3m 47s
|
|
#
|
|
# Using `lto = "thin"` brings a massive improvement, but it's still slow:
|
|
#
|
|
# $ cargo b --profile profiling -p uv
|
|
# Compiling uv v0.2.34 (/home/andrew/astral/uv/crates/uv)
|
|
# Finished `profiling` profile [optimized + debuginfo] target(s) in 53.98s
|
|
#
|
|
# But with `lto = false`:
|
|
#
|
|
# $ cargo b --profile profiling -p uv
|
|
# Compiling uv v0.2.34 (/home/andrew/astral/uv/crates/uv)
|
|
# Finished `profiling` profile [optimized + debuginfo] target(s) in 30.09s
|
|
#
|
|
# We get more reasonable-ish compile times. At least, it's not enough
|
|
# time to get up and get a cup of coffee before it completes.
|
|
#
|
|
# This setup does risk that we are measuring something in benchmarks
|
|
# that we are shipping, but in order to make those two the same, we'd
|
|
# either need to make compile times way worse for development, or take
|
|
# a hit to binary size and a slight hit to runtime performance in our
|
|
# release builds.
|
|
[profile.profiling]
|
|
inherits = "release"
|
|
strip = false
|
|
debug = "full"
|
|
lto = false
|
|
|
|
[profile.fast-build]
|
|
inherits = "dev"
|
|
debug = 0
|
|
strip = "debuginfo"
|
|
|
|
# Profile to build a minimally sized binary for uv-build
|
|
[profile.minimal-size]
|
|
inherits = "release"
|
|
opt-level = "z"
|
|
# This will still show a panic message, we only skip the unwind
|
|
panic = "abort"
|
|
codegen-units = 1
|
|
|
|
# The profile that 'cargo dist' will build with.
|
|
[profile.dist]
|
|
inherits = "release"
|
|
|
|
[patch.crates-io]
|
|
reqwest-middleware = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "ad8b9d332d1773fde8b4cd008486de5973e0a3f8" }
|
|
reqwest-retry = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "ad8b9d332d1773fde8b4cd008486de5973e0a3f8" }
|