`DashMap` has a lot of deadlock conditions. Our cases aren't about
performance, but about concurrent access, and deadlocks are a bad
experience for users (aka CI getting stuck for 6h until the hard job
limit kills it).
## Summary
Update the MSRV to 1.94.0, the pinned Rust toolchain to 1.96.0, and the
trampoline nightly toolchain to remain compatible with the new MSRV.
This adds abstractions for handing hints, pulling them out of ad-hoc
addendums to error messages and treating them as a first-class concept
so we can render them more consistently.
The key concepts are:
- `Hints`: a wrapper struct for `Vec<Cow<'a, str>>`
- `Hint`: a trait with `hints(&self) -> Hints<'_>`
Error types now `impl Hint` to provide hints. This means errors need to
carry more information to construct the `Hint` lazily instead of ahead
of time. The majority of refactoring around error types is to support
that change.
When displaying errors, we
[downcast](https://github.com/astral-sh/uv/pull/18090/changes#r2935662966)
to each type known to implement the trait and extract hints. We then
display all the hints after the error chain is complete.
The user-facing affect of this is that hints are now always rendered
outside the error chain.
This is a blocker to #17110 and is pulled out of that project. There is
still some weirdness with miette's `help:` prompts that will be removed
entirely in a following change.
---------
Co-authored-by: Codex <noreply@openai.com>
[TOML 1.1](https://github.com/toml-lang/toml/releases/tag/1.1.0)
introduces support for new syntax that older tools with only TOML 1.0
support don't understand.
Usually, the user is either in control of which tools need to read the
TOML files or the TOML gets converted before publishing (for wheels:
`pyproject.toml` -> `METADATA`). The specific case where this doesn't
work is when a package manager that only support TOML 1.0 tries to build
the source distribution of a dependency. Build tools need to parse
`pyproject.toml` in source distributions to extract the `[build-system]`
table, and if any other part of the file contains TOML 1.1 syntax, they
fail to build. This generally doesn't trigger backtracking, so the user
is left with a failure when any (transitive) dependency in their
dependency tree has started using a single instance of TOML 1.1. Most
package managers, including pip, are implemented in Python and use
stdlib's tomllib, which only support TOML 1.0 up to including Python
3.14.
To work around this, we do a best-effort rewrite of `pyproject.toml` to
TOML 1.0 during source distribution builds.
This approach is inspired by Cargo, which has been successfully
rewriting published `Cargo.toml`s for many versions. While the `toml`
crate doesn't guarantee this downgrade always works
(https://github.com/toml-rs/toml/issues/1088), this crate is also used
by Cargo, and this best effort rewrite handles the biggest failure case:
Newlines and trailing commas in inline tables. Similarly following
Cargo, we also add a `pyproject.toml.orig` to the source distribution.
https://discuss.python.org/t/adopting-toml-1-1/105624 was inconclusive,
but a best-in-class tool should do this transformation.
---------
Co-authored-by: Tomasz (Tom) Kramkowski <tom@astral.sh>
## Summary
The motivation and approach here is identical to #19365, but for tar.
This doesn't have a meaningful effect on build size (since we _only_ use
`tar` in `uv-build` and `astral-tokio-tar` in `uv`), but it does mean we
aren't exposed to CVEs in `tar`.
## Summary
This follows the pattern we use for GCS and AWS: set
`UV_AZURE_ENDPOINT_URL`, then we use `AZURE_CLIENT_ID`,
`AZURE_TENANT_ID`, and `AZURE_FEDERATED_TOKEN_FILE` to sign requests to
that endpoint (or the CLI authentication, based on `reqsign`'s default
precedence).
Closes https://github.com/astral-sh/uv/issues/19420.
## Summary
This is entirely written by Codex, but the intent is to use
~~`windows_registry`~~ the configuration manager APIs (from Win32)
instead of `wmi` for Intel XPU detection. (We _only_ use `wmi` for this
one use-case, which seems not-worth-it.)
---------
Signed-off-by: William Woodruff <william@yossarian.net>
Co-authored-by: William Woodruff <william@yossarian.net>
## Summary
Historically, we've relied on both the synchronous `zip` crate and our
own `rs-async-zip` fork. The async variant is used for streaming (i.e.,
unzipping a wheel as it's downloaded), while the sync variant is used to
parallel-unzip local files, which turns out to be very fast.
This PR removes all usages of the `zip` crate (apart from in development
dependencies), in favor of using `rs-async-zip` everywhere. This appears
to both reduce crate size _and_ improve performance while also cutting
off a source of CVEs. (The `rs-async-zip` crate is, of course, also
vulnerable to potential CVEs, but having _two_ crates is strictly
greater exposure for us.)
Per Codex, the parallel unzip is now a bit faster:
```
- 55 KB wheel: async -1.0%
- 393 KB wheel: async -7.8%
- 11.4 MB shellcheck wheel: async -3.8%
- 12.5 MB Ruff wheel: async -9.1%
- 21.3 MB NumPy wheel: async -11.0%
- 66.5 MB pandas wheel: async -4.3%
```
Per Codex, the `uv` and `uv-build` binaries are both smaller:
```
┌──────────┬──────────────┬──────────────┬─────────────────────────────────┐
│ Binary │ main │ branch │ delta │
├──────────┼──────────────┼──────────────┼─────────────────────────────────┤
│ uv │ 16,422,784 B │ 16,274,608 B │ -148,176 B (-144.7 KiB, -0.90%) │
│ uv-build │ 2,683,584 B │ 2,652,512 B │ -31,072 B (-30.3 KiB, -1.16%) │
└──────────┴──────────────┴──────────────┴─────────────────────────────────┘
```
Closes https://github.com/astral-sh/uv/issues/19363.
## Summary
This introduces a new workspace member, `uv-fastid`. `uv-fastid`
provides IDs using the same alphabet as nanoid, but with a slightly
smaller token size (16 instead of 21) and fewer knobs for configuration.
In practice it should also be faster, since our IDs are now trivially
copyable + don't require any heap allocations to construct internally.
This is probably not a huge deal in our case anyways (ID generation
isn't exactly dominating our runtime), but it doesn't hurt to have a
fast primitive here.
The two main APIs I've added are `insecure()` and `secure()`, whose
names refer to the kind of PRNG they use internally. Right now we only
use `insecure()`, since we don't actually need a CSPRNG for the uses of
nanoid we're replacing (revision and archive IDs).
Some other notes:
- Arguably we could remove the secure/insecure distinction entirely, and
just keep the CSPRNG path -- with `rand` we have a purely userspace
CSPRNG (seeded from the OS's CSPRNG), so we don't really need `fastrand`
for performance here.
- I'm guilty of using `unsafe` in this, although I think the usage is
demonstrably safe (as long as crate-private invariants are maintained) 🙂
- I think there's no breakage risk with this -- FWICT our only usage of
`nanoid` doesn't make any format assumptions, so switching to a slightly
shorter ID form here shouldn't break anything. Our previous IDs also
aren't part of any public interface AFAICT.
Closes https://github.com/astral-sh/uv/pull/19176.
## Test Plan
Added unit tests to the new `uv-fastid` crate. Our existing tests should
cover this transitively as well.
---------
Signed-off-by: William Woodruff <william@astral.sh>
## Summary
We were only using this crate in one place, in a Windows-specific test
helper where accessing `%USERNAME%` should work just as well.
(This isn't super critical, but it reduces our dependency footprint
slightly.)
## Test Plan
The existing tests should continue to pass with this change.
Signed-off-by: William Woodruff <william@astral.sh>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [similar](https://redirect.github.com/mitsuhiko/similar) |
workspace.dependencies | major | `2.6.0` → `3.0.0` |
---
### Release Notes
<details>
<summary>mitsuhiko/similar (similar)</summary>
###
[`v3.1.0`](https://redirect.github.com/mitsuhiko/similar/blob/HEAD/CHANGELOG.md#310)
[Compare
Source](https://redirect.github.com/mitsuhiko/similar/compare/3.0.0...3.1.0)
- Added `capture_diff_slices_by_key` and
`capture_diff_slices_by_key_deadline`
as convenience helpers for diffing slices by derived keys.
- Fixed `Compact` emitting inconsistent `DiffOp` cursor positions after
compaction, which could leave `Delete`/`Insert` operations with stale
`new_index`/`old_index` values.
- Added explicit lifetime capture (`+ use<...>`) on iterator-returning
APIs to
improve compatibility with Rust 2024 lifetime capture behavior.
[#​93](https://redirect.github.com/mitsuhiko/similar/issues/93)
###
[`v3.0.0`](https://redirect.github.com/mitsuhiko/similar/blob/HEAD/CHANGELOG.md#300)
[Compare
Source](https://redirect.github.com/mitsuhiko/similar/compare/2.7.0...3.0.0)
- Added a Git-style Histogram diff implementation exposed as
`Algorithm::Histogram`, including deadline-aware Myers fallback and
comprehensive regression/behavior tests.
- Raised MSRV to Rust 1.85 and moved the crate to Rust 2024 edition.
- Added a Hunt-style diff implementation exposed as `Algorithm::Hunt`.
- Added configurable inline refinement via `InlineChangeOptions` and
`InlineChangeMode`, including semantic cleanup and new
`TextDiff::iter_inline_changes_with_options*` methods.
[#​92](https://redirect.github.com/mitsuhiko/similar/issues/92)
- Added a global disjoint-input fast path in `algorithms::diff_deadline`
to avoid pathological runtimes on large, fully distinct inputs.
- Improved `Algorithm::Myers` performance on heavily unbalanced diffs to
avoid pathological slowdowns.
- Added `diff_deadline_raw` entrypoints in the algorithm modules to
bypass
shared heuristics and keep minimal intrinsic trait bounds where needed.
- Added test files in `examples/diffs` that can be used with the some of
the
examples as input pairs.
- Added `CachedLookup`, a helper for adapting virtual or computed
sequences by
materializing items on first access and then serving borrowed values
through
normal indexing. The `owned-lookup` example demonstrates this approach
for
issue
[#​33](https://redirect.github.com/mitsuhiko/similar/issues/33).
- Fixed ranged indexing in the classic LCS table algorithm.
- Improved diff compaction to merge adjacent delete hunks across equal
runs.
- Excluded development scripts from published crate contents.
[#​87](https://redirect.github.com/mitsuhiko/similar/issues/87)
- `TextDiff::from_*` and `TextDiffConfig::diff_*` now accept owned
inputs
(`String`, `Vec<u8>`, `Cow`) in addition to borrowed inputs. This allows
returning text diffs from functions without external owner lifetimes.
[#​65](https://redirect.github.com/mitsuhiko/similar/issues/65)
- `TextDiff` no longer exposes `old_slices` / `new_slices`. Use
`old_len`, `new_len`, `old_slice`, `new_slice`, `iter_old_slices`,
`iter_new_slices`, `old_lookup`, and `new_lookup` instead.
- `TextDiff::iter_changes` now panics on invalid out-of-bounds `DiffOp`
ranges instead of silently truncating iteration.
- `utils::diff_lines_inline` now takes `&TextDiff` and options rather
than
`(Algorithm, old, new, options)`.
- `utils::diff_lines` now avoids a second line-tokenization pass.
- Renamed `get_diff_ratio` to `diff_ratio`.
- Added first-class `no_std + alloc` support with an explicit default
`std`
feature.
- Added optional `hashbrown` backend for `no_std` map storage
(`default-features = false, features = ["hashbrown"]`), while the
default
`no_std` backend uses `alloc::collections::BTreeMap`.
- Made core constructors const-ready (`Capture::new`, `Replace::new`,
`NoFinishHook::new`, `InlineChangeOptions::new`, `TextDiff::configure`).
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjEyMy44IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJidWlsZDpza2lwLWRvY2tlciIsImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
See https://github.com/astral-sh/uv/issues/18890
Adds special-case validation for `SSL_CERT_FILE` and `SSL_CERT_DIR`
where we actually check if webpki will accept the given certificates
and, if not, emit a better error message about why. This means we
perform eager validation of certificates, parsing them more than once
since reqwest will parse them again on client build. Unfortunately,
there's not a straight-forward way to provide our pre-parsed
certificates to reqwest without doing a lot more work. Nor is there a
clear way to retrieve the parsed certificates on error.
We use https://github.com/rusticata/x509-parser for parsing which seems
reputable.
We may want to _drop_ all invalid certificates instead, but that can be
a future decision and this machinery can be reused for warnings.
Ideally webpki would just have better error messages, but that's a
separate project.
This updates async_http_range_reader to v0.11.0 to add the missing range
request bounds validation:
https://github.com/astral-sh/async_http_range_reader/pull/8.
An open question is how we want to behave when the server has an
incorrect range request implementation (while advertising range request
support). In the current implementation, it warns with the index URL, so
that the user is aware that the massive slowdown is caused by a server
advertising broken features.
Also removes a dependency where the corresponding repo was deleted.
Fixes https://github.com/astral-sh/uv/issues/18316
Aria Desires