## Summary
Based on #19924.
Handle the case where a `pyproject.toml` sits between a member and its
workspace root.
This unintentionally supported case regressed when adding workspace
caching, which memorises which projects are members of a workspace
without requiring re-discovery, ignoring a `pyproject.toml` in the
middle. Before caching, workspace discovery for this project starting
from the project itself would terminate at the intermediate
`pyroject.toml` and treat it as standalone project, which this hack
restores.
Fixes#19916
## Test Plan
Added a regression test, unlike for Konsti's version of the PR, we have
existing coverage for the case where we mess this up so we don't need a
second test to cover it.
Co-authored-by: konstin <konstin@mailbox.org>
This reverts commit 18898c9821 (#19890).
Fixes#19920
While we think this is probably something pre-commit-uv should fix, it's
friday afternoon and this seems like the lowest friction solution to the
breakage.
The release-preparation workflow exposes a contents- and
pull-request-write `GITHUB_TOKEN` while running `rooster`.
`rooster@0.1.1` was pinned, but `uvx` still resolved its transitive
dependencies at runtime, so code outside the repository lock could
execute with that token.
Add a dedicated Python 3.12+ `release` dependency group containing
`rooster==0.1.1`, commit its full dependency graph to `uv.lock`, and
invoke it with `uv run --locked --python 3.12 --only-group release`.
In a similar way that #19860 needs to add a top-level script node to
represent dependencies of the script, it's been an outstanding issue
that we lack a top-level workspace node to represent dependency-groups
that are exclusive to the workspace.
Like other `--script` commands this tells uv to ignore the current
workspace and only handle the PEP 723 script at the given path, with its
own lock and venv.
## Summary
`uv check --no-sync` currently skips the project lock operation along
with environment synchronization. This means it does not create a
missing `uv.lock` or update a stale one.
This changes `--no-sync` to control environment synchronization only.
`uv check` now performs the normal project lock operation, uses the
resulting lock for workspace metadata, and then skips synchronizing
project dependencies into the environment. When an existing environment
is incompatible with the project or an explicit Python request, locking
discovers a separate compatible interpreter without replacing or
synchronizing that environment.
Explicit lock controls continue to apply when combined with `--no-sync`:
- `--locked` validates the lockfile without writing it
- `--frozen` uses the existing lockfile without freshness validation or
writes
- `--isolated` performs dry-run locking and leaves project state
unchanged
As a consequence, malformed lockfiles now produce an error instead of
being ignored.
Now that uv’s MSRV is Rust 1.94, use Rust 2024 let chains where they
make nested guards clearer in the parser, configuration, and data-model
crates.
This flattens related pattern matches and predicates while preserving
evaluation order, short-circuiting, borrow scopes, and mutation
behavior. Guards involving effects, staged work, or non-obvious
lifetimes remain nested.
## Summary
Prior to this change, requirements attached directly to a synthetic `uv
tree` root were handled differently from dependencies on workspace
packages. We traversed every manifest-level dependency group regardless
of the requested group selection, and discarded extras requested by
those requirements when creating root edges.
This filters projectless workspace dependency groups through the
selected groups, matching package-backed dependency groups. It also
carries requirement extras on synthetic-root edges and queues those
optional dependency contexts, so a requirement such as `child[feature]`
is rendered with its requested extra and includes feature-only
descendants. The same behavior applies to PEP 723 script requirements,
which use the same synthetic-root path.
The regression coverage verifies that `--only-group dev` excludes an
unselected group while expanding a selected extra, and separately covers
extras requested by a script requirement. Existing projectless-workspace
snapshots now request non-default groups explicitly.
`DashMap` has a lot of deadlock conditions. Our cases aren't about
performance, but about concurrent access, and deadlocks are a bad
experience for users (aka CI getting stuck for 6h until the hard job
limit kills it).
## Summary
Store the `<maj>.<min>` Python version in project environments when an
upgradeable Python request is used so that the environment can actually
be re-used when the referenced python interpreter is upgraded.
Previously we'd always write the full version which meant that we
considered the environment to always be out of date even if the symlink
had been upgraded.
## Test Plan
Added a new test specifically for this, and adjusted an existing test to
ensure that non-upgradeable environments didn't regress.
Verified that dropping the fix would trigger every one of the new
regression test's checks.
## Summary
This is a refactor of `uv_python::implementation::ImplementationName`.
It gets rid of the From impls in favour of just having functions which
returns the long and short names for an implementation. I think this is
just strictly cleaner at the call sites, and is less code. It gets rid
of the `long_names` and `short_names` functions in favour of using the
existing `iter_all`. It uses these changes to centralise a bunch of the
information so the short and long names aren't duplicated in various
locations anymore.
The PR becomes most useful for the centralised environments PR but the
refactor seemed helpful stand-alone and is completely isolated from that
PR.
## Test Plan
Relies on existing coverage.
Now that uv’s MSRV is Rust 1.94, use clearer `Option` and `Result`
predicate helpers where it makes sense.
This replaces `map(...).unwrap_or(...)` probes with APIs such as
`is_some_and`, `is_none_or`, and `is_ok_and`, preserving existing
ownership and `None`/`Err` behavior.
## Summary
Adds hidden `uv check --show-version` support, matching the existing `uv
format --show-version` convention. The flag now reports `Using ty
<version>` for both `TY` executable overrides and resolved/downloaded ty
binaries, without relying on debug logging or the separate lock-pinning
work.
This threads the hidden flag through CLI/settings/check execution and
updates focused integration coverage for both version-selection paths.
## Summary
We added a global workspace lock for project-oriented uv commands
creating/re-creating venvs but the same was not done for `uv venv` when
it operates on a project environment.
This PR remedies this.
## Test Plan
There's a new test, not sure how good of an idea it is to set RUST_LOG
there....
## Summary
Prior to this change, PEP 517 build hooks that invoked uv failed while
building a wheel from a source distribution. `uv build` extracts the
generated source distribution into uv's cache, so the nested uv
invocation treated the extracted project as an unsupported project
inside the configured cache and exited before the hook could complete.
This records the exact PEP 517 source tree in a hidden internal
environment variable and exempts nested uv invocations only when their
project directory is within that uv-managed tree. Other projects inside
the cache remain rejected, including paths that require canonicalization
to detect.
The regression coverage uses a Hatchling custom build hook that invokes
`uv export`, matching the reported failure while building both the
source distribution and wheel.
Closes https://github.com/astral-sh/uv/issues/19878.
---------
Co-authored-by: Zanie Blue <contact@zanie.dev>
## Summary
Prior to this change, uv parsed the `lock-version` field in
`pylock.toml` files but never checked whether that version was
supported. As a result, a lock file declaring an incompatible major
version such as `2.0` was installed normally.
This validates the lock version immediately after deserialization, both
when installing from a lock file and when reusing an existing output
file during an upgrade. Major version 1 remains forward-compatible with
later minor versions, while unsupported major versions now produce a
direct error as required by PEP 751.
The regression coverage verifies that version 2.0 is rejected and that a
future version 1.1 remains accepted.
## Summary
PEP 685 requires tools to reject extra names that collide after
normalization. Both the workspace parser and uv-build previously parsed
`project.optional-dependencies` directly into maps keyed by `ExtraName`,
so entries such as `foo-bar` and `foo_bar` silently overwrote one
another.
Detect duplicate normalized extra names during deserialization in both
paths and report a TOML parse error instead. The regression coverage
exercises both workspace and build-backend parsing.
## Summary
Prior to this change, a dependency-group object containing
`include-group` alongside additional keys was accepted as a group
include. We silently discarded the additional fields even though the
current specification defines an include object as containing exactly
one key.
This recognizes `include-group` only when it is the object's sole key.
Mixed tables are preserved as dependency object specifiers, allowing
future syntax to deserialize without being misinterpreted, while the
existing semantic validation rejects them when their group is processed.
The focused coverage verifies both that mixed tables retain all of their
fields during deserialization and that `uv lock` rejects the currently
unsupported object when resolving its group.
## Summary
Prior to this change, uv parsed `packages.requires-python` from
`pylock.toml` files but did not enforce it. A package selected for
installation could therefore require a different Python version than the
target environment.
This checks each selected package's Python requirement immediately after
evaluating its marker. Packages excluded by their marker remain skipped,
while a selected package with an incompatible requirement now produces a
direct error before its source is processed.
The regression coverage verifies both the skipped-marker case and the
incompatible selected-package case.
## Summary
Prior to this change, `uv pip list` assumed that every installed
editable direct URL could be converted to a local file path. An editable
`direct_url.json` containing a non-file URL caused both the columns and
JSON output formats to panic.
This handles the URL-to-path conversion fallibly and omits the editable
project location when the URL does not identify a local path, matching
`uv pip show`.
The regression test constructs the installed metadata directly and
verifies both output formats.
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [criterion](https://codspeed.io)
([source](https://redirect.github.com/CodSpeedHQ/codspeed-rust)) |
dev-dependencies | minor | `4.6.0` → `4.7.0` |
---
### Release Notes
<details>
<summary>CodSpeedHQ/codspeed-rust (criterion)</summary>
###
[`v4.7.0`](https://redirect.github.com/CodSpeedHQ/codspeed-rust/releases/tag/v4.7.0)
[Compare
Source](https://redirect.github.com/CodSpeedHQ/codspeed-rust/compare/v4.6.0...v4.7.0)
#### What's Changed
##### Manual sampling for criterion
> **Note:** ignored under CodSpeed simulation mode (single measured
iteration). Only takes effect in walltime mode.
We introduced a new finer control way of defining a criterion benchmark
to have full control over how many times your code is ran.\
This bypasses criterion's original sampler, which we still recommend
using if you do not have specific control needs.
```rust
use codspeed_criterion_compat::{criterion_group, criterion_main, Criterion, IterManualOptions};
fn bench_my_function(c: &mut Criterion) {
c.bench_function("my_function", |b| {
b.iter_manual_unstable(
IterManualOptions::new()
.rounds(5) // 5 measurement samples, can be lower than criterion's imposed 10
.iters(1000) // 1000 calls per sample
.warmup(5), // 5 unmeasured warmup iterations
|| my_function(),
);
});
}
criterion_group!(benches, bench_my_function);
criterion_main!(benches);
```
Please note that this API is still under development and may change with
future releases.
- fix(cargo-codspeed): forward args after `--` to bench binaries by
[@​not-matthias](https://redirect.github.com/not-matthias) in
[#​179](https://redirect.github.com/CodSpeedHQ/codspeed-rust/pull/179)
- chore: bump instrument-hooks by
[@​not-matthias](https://redirect.github.com/not-matthias) in
[#​178](https://redirect.github.com/CodSpeedHQ/codspeed-rust/pull/178)
- feat(criterion-compat): add `iter_manual` to have finer control over
the iteration loop by
[@​GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in
[#​180](https://redirect.github.com/CodSpeedHQ/codspeed-rust/pull/180)
**Full Changelog**:
<https://github.com/CodSpeedHQ/codspeed-rust/compare/v4.6.0...v4.7.0>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjIwOS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJidWlsZDpza2lwLWRvY2tlciIsImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
## Summary
While centralising the whole environment, I noticed that this code was
unnecessarily complicated so I deleted it.
Using `remove_dir` instead of `junction::delete` also fixes a bug of
sorts if we were to actually encounter a regular directory symlink on
windows.
`junction::get_target` has this weird quirk where it will produce
non-verbatim long paths. This means that prefix comparisons will work
assuming the prefix isn't a verbatim path (so actually this is a bug
disguised as a feature).
To avoid the opposite issue in this case, it's necessary to verbatim
both paths.
## Test Plan
Existing coverage, some augmentations, and a targeted test for a
verbatim_path idiom.
## Summary
This is a continuation of the excellent work by @j-helland in #16452 and
#17202 and closes#15767.
This PR adds `preview-features` to `uv.toml` and `pyproject.toml`.
This field can be set to a boolean or to a list of features.
It is intended to supersede the `preview` setting itself, and conflicts
with it.
There's a little bit of complexity required to ensure that setting
either `preview` or `preview-features` is combined at the right point,
but it's also necessary to leave them split to accurately warn when a
`uv.toml` masks a `pyproject.toml` in the same directory.
Additionally there's complexity involved in making things work with
`deny_unknown_fields` and `flatten` (they're incompatible so require
manual flattening) and also this improves error messages somewhat.
Also (supersedes) closes#16452 and (supersedes) closes#17202.
## Test Plan
Tests taken from the original PR with some alterations and a bunch of
additional tests.
---------
Co-authored-by: j-helland <jonathan.w.helland@gmail.com>
Co-authored-by: Zanie Blue <contact@zanie.dev>
## Summary
This addresses a small papercut: high-activity projects that publish to
PyPI generally prefer to have their wheels published first, so that
installations degrade gracefully (falling back to an older release)
rather than failing because the sdist fails to build.
This matches twine's behavior.
## Test Plan
One line change, added a test demonstrating upload order.
---------
Signed-off-by: William Woodruff <william@yossarian.net>
Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
## Summary
Prior to this change, we added `backend-path` entries to `sys.path`
without checking that they existed in the current source tree. When an
in-tree backend was omitted from an sdist, the subsequent wheel build
failed with `ModuleNotFoundError` and suggested that the backend was an
undeclared build dependency.
This validates each `backend-path` entry before resolving or invoking
the backend. Missing directories now produce a direct error explaining
that the configured path does not exist, matching the behavior of PyPA's
`build` frontend.
The regression test builds an sdist with a Flit wrapper in
`backend_dir`, intentionally omits that directory from the sdist, and
verifies the diagnostic during the wheel-from-sdist build.
Closes https://github.com/astral-sh/uv/issues/19771.
## Summary
Prior to this change, we used lexicographic ordering for pure
string-valued environment markers. For example, with `os_name =
"posix"`, both `os_name > "nt"` and `os_name >= "nt"` evaluated to true.
The [current dependency
specification](https://packaging.python.org/en/latest/specifications/dependency-specifiers/#marker-comparisons),
updated by
[pypa/packaging.python.org#1988](https://github.com/pypa/packaging.python.org/pull/1988),
defines strict string comparisons (`>` and `<`) as always false, while
inclusive comparisons (`>=` and `<=`) are equivalent to equality. This
applies those rules to every pure String marker field, including
reversed operand forms.
`platform_release` and `platform_version` remain on their existing
comparison path because the specification types them as `Version |
String` rather than pure strings.
## Summary
Removes a few more template injections, drops a blanket permission.
Previously we couldn't address these because they're part of the
generated dist workflow, but now that we're committed to it being dirty
this is fine.
## Test Plan
See what happens in CI.
---------
Signed-off-by: William Woodruff <william@yossarian.net>
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:
- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->
## Summary
Each of these tests needs to connect to PyPI over the network.
Conditionalize them all on `test-pypi` to support offline testing.
## Test Plan
Applied as a downstream patch to the `uv` package in Fedora.
<!-- How was it tested? -->
## Summary
This is a one-line fix, the rest of the change is tests.
TL;DR is we have `Default` on this type, but we also need a serde
default marker to ensure that an empty or comment-only input
deserializes as expected.
Fixes#19811.
## Test Plan
Two new tests.
Signed-off-by: William Woodruff <william@yossarian.net>
Aria Desires