87 Commits
Author SHA1 Message Date
Aria Desires 3cdf50e092 Bump version to 0.11.23 (#19927) 2026-06-19 10:42:39 -07:00
Aria Desires a058272654 Revert "Fix transparent Python upgrades in project environments" (#19925)
This reverts commit 18898c9821 (#19890).

Fixes #19920

While we think this is probably something pre-commit-uv should fix, it's
friday afternoon and this seems like the lowest friction solution to the
breakage.
2026-06-19 09:51:37 -07:00
Aria Desires 94988e5e08 Bump version to 0.11.22 (#19917) 2026-06-18 15:06:46 -07:00
Aria Desires f98013ef81 Add workspace-exclusive dependency groups to workspace metadata (#19862)
In a similar way that #19860 needs to add a top-level script node to
represent dependencies of the script, it's been an outstanding issue
that we lack a top-level workspace node to represent dependency-groups
that are exclusive to the workspace.
2026-06-18 12:53:24 -07:00
Aria Desires 7f3ab0449a Add --script to uv check and uv metadata (#19860)
Like other `--script` commands this tells uv to ignore the current
workspace and only handle the PEP 723 script at the given path, with its
own lock and venv.
2026-06-18 12:35:52 -07:00
Aria Desires e83afa5d90 Add TY and RUFF env vars for providing paths of binaries used by format and check (#19821)
This should be useful for local integration testing while developing
cross-tool functionality.
2026-06-12 09:37:54 -07:00
Aria Desires 1379b7d8fa Compute and pass uv workspace metadata payload in ty check (#19763)
This is my proposed solution to the `uv -> ty -> uv` gordian know that
`uv check` uniquely presents. By doing this we get properly handling of
`--isolated`, `--index`, and so on "for free" by virtue of ty not
needing to call back into us. Also it's just more efficient than ty
doing a callback.

This *does not* preclude ty knowing how to call into uv when it's
invoked standalone, but in that case ty can be fully in charge of the
config/interface so we don't need to worry about preserving it (i.e. we
can just tell users to use persistent config or env-vars and they don't
have a reason to complain about consistency).
2026-06-11 17:05:58 +00:00
Aria Desires 4690f46370 Add environment.root to uv workspace metadata --sync (#19760)
This is a field of particular interest to `ty`, especially if
`--isolated` or `--script` stuff is going on. Possibly also enables a
future where we don't necessarily store the workspace venv in the
project dir.

Adding it here first to establish it in the schema, further integrations
will be in followups.
2026-06-10 14:18:30 +00:00
Aria Desires 8df759892c fix feature-gates on format and check tests to specify they access r2 (#19661)
The test-pypi feature was used as a proxy for "this test does
networking" so people running in offline scenarios don't run them, but
the more accurate gate is on r2.

Fixes #19658
2026-06-03 17:22:04 +00:00
Aria Desires 146e2efa70 Set TY_UV=1 when invoking ty through uv check (#19655)
## Summary

I want to use this as the opt-in for an experimental support for ty to
try to call into uv. Once we're confident enough in the functionality we
can make this the default and e.g. have a TY_NO_UV env-var to opt-out.
2026-06-03 11:30:44 +01:00
Aria Desires cef324a76a Make preview features for commands have names that aren't ambiguous with the command (#19645)
## Summary

The old names are still read properly, but now `format-command`,
`check-command`, and `audit-command` are the preferred names we show in
diagnostics.

This avoids the confusion in
https://github.com/astral-sh/uv/issues/19643
2026-06-02 08:17:44 -07:00
Aria Desires 94e66c36f6 [check] you're not special, ty (#19609)
## Summary

This is a followup to #19605 that moves `uv check` towards more of a
design where ty is "just one of the things uv check does", primarily by
removing support for forwarding arbitrary arguments with `--`.

## Test Plan

Mostly this is just removing functionality.
2026-06-01 13:11:54 -05:00
Aria Desires f69c1b274b Add uv check to run ty from uv (#19605)
## Summary

This is the minimal implementation for fetching and running `ty check`.
Currently it doesn't attempt to provide member selection information to
ty, specifying semantics that are essentially "this downloads and runs
ty in cwd, you can pass arbitrary flags to ty yourself".

This is therefore reasonably far from the potential vision of "check is
a monolithic linter command", but might still be worth landing to
iterate on, because most of the implementation is still what we want --
download ty, run sync, invoke ty.

## Test Plan

Zanie and I reviewed it and various tests were added. Not sweating the details too hard so we can iterate.
2026-05-29 13:44:06 -07:00
Aria Desires a33a629d66 Bump version to 0.11.17 (#19599) 2026-05-28 12:58:35 -07:00
Aria Desires ce8b4912c6 Fix test filter to work with dot-dirs (#19318) 2026-05-07 09:24:54 -07:00
Aria Desires 732ecd8828 Support uv lock on a pyproject.toml that only contains dependency-groups (#19087)
## Summary

These special kinds of pyproject.tomls are blessed by the standards
gods. Initially we only supported it in `uv pip install` but at some
point `uv sync` started supporting it. However `uv lock` would still
hard error which is definitely "everything is wrong".

## Test Plan

Included is 3 tests:

* showing sync always worked
* showing lock was broken and now works
* showing that `conflicts` currently doesn't work (because internally we
always expect a Conflict to include a PackageName)
2026-04-21 13:12:35 -04:00
Aria Desires 202e0f0831 Expand uv workspace metadata with dependency information from the lock (#18356)
## Summary

This expands `uv workspace metadata` with many of the fields that are
found in `uv.lock` so that we have a format with information about the
dependency graph/resolution that we're willing to call stable and have
people rely upon (rather than `uv.lock` which we'd rather you don't try
to interpret).

To a first approximation you can think of this as "uv.lock but
serialized to json" but with the fields a bit more limited for now (easy
to add later).

The biggest intentional divergence with uv.lock is that we favour
encoding the dependency graph in a form that looks more like our
internal "resolve" graph, in that hopes that it will simplify the work
of anyone doing analysis on the graph (we structure our internal graph
like this for a reason).

Specifically, the `resolve` field contains the entire dependency graph,
with packages desugarred into several different nodes. There are 4 kinds
of nodes (really 3, the build nodes will only be introduced when we
establish build-dependency locking):

* packages: `mypackage==1.0.0 @ registry+https://pypi.org/simple`
* extras: `mypackage[myextra]==1.0.0 @ registry+https://pypi.org/simple`
* groups: `mypackage:mygroup==1.0.0 @ registry+https://pypi.org/simple`
* build:    `mypackage(build)==1.0.0 @ registry+https://pypi.org/simple`

package nodes hold additional metadata about the package itself, and ids
of the associated extra/group/build nodes.

---

A package like this:

```toml
[project]
name = "mypackage"
version = "1.0.0"

dependencies = ["httpx"]

[project.optional-dependencies]
cli = ["rich"]

[dependency-groups]
dev = ["typing-extensions"]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
```

will get 4 nodes with the following edges (Version and Source omitted
here for brevity):
* `mypackage`
  * `httpx`
* `mypackage(build)`
  * `hatchling`
* `mypackage[cli]`
  * `mypackage`
  * `rich`
* `mypackage:dev`
  * `typing-extensions`
  
Note that `mypackage[cli]` has a dependency edge on `mypackage` while
`mypackage:dev` does not. This is because
`mypackage[cli]` is fundamentally an augmentation of `mypackage` while
`mypackage:dev` is just a list of packages that happens to be defined by
`mypackage`'s pyproject.toml.
 
 The resulting nodes for `mypackage` will look something like:
 
 <details>
 <summary>json blob</summary>
 
```json
{
  "resolve": {
    "mypackage==1.0.0 @ editable+.": {
      "name": "mypackage",
      "version": "1.0.0",
      "source": {
        "editable": "."
      },
      "kind": "package",
      "dependencies": [
        {
          "id": "httpx==3.6 @ registry+https://pypi.org/simple"
          "marker": "sys_platform == 'linux'"
        },
      ],
      "optional_dependencies": [
        {
          "name": "cli",
          "id": "mypackage[cli]==1.0.0 @ editable+."
        },
      ],
      "dependency_groups": [
        {
          "name": "dev",
          "id": "mypackage:dev==1.0.0 @ editable+."
        }
      ]
      "build_system": {
        "build_backend": "hatchling.build",
        "id": "mypackage(build)==1.0.0 @ editable+."
      }
      "sdist": { ... },
      "wheels": [ ... ]
    },
    "mypackage:dev==1.0.0 @ editable+.": {
        "name": "mypackage",
        "version": "1.0.0",
        "source": {
          "editable": "."
        },
        "kind": {
          "group": "dev"
        },
        "dependencies": [
          {
            "id": "typing-extensions==1.2.3 @ registry+https://pypi.org/simple"
          },
        ]
      },
   }
   "mypackage[cli]==1.0.0 @ editable+.": {
      "name": "mypackage",
      "version": "1.0.0",
      "source": {
        "editable": "."
      },
      "kind": {
        "extra": "cli"
      },
      "dependencies": [
        {
          "id": "rich==2.2.3 @ registry+https://pypi.org/simple"
        },
        {
          "id": "mypackage==1.0.0 @ editable+."
        },
      ]
    },
    "mypackage(build)==1.0.0 @ editable+.": {
      "name": "mypackage",
      "version": "1.0.0",
      "source": {
        "editable": "."
      },
      "kind": "build",
      "dependencies": [
        {
          "id": "hatchling==3.2.3 @ registry+https://pypi.org/simple"
        },
      ]
    }
  }
}
```

</details>

## Test Plan

Snapshots
2026-03-27 09:22:03 -04:00
Aria Desires d71ae61c0b Fix github attestations of releases (#16530) 2025-10-30 22:31:19 -04:00
Aria Desires b06f02f13d Fix typo in _CONDA_ROOT docs (#16114)
All other references are correct, just slipped through in the actual
docs.
2025-10-03 10:38:00 -05:00
Aria DesiresandZanie Blue 1943aba150 Allow [project] to be missing from a pyproject.toml (#14113)
Closes #8666 
Closes https://github.com/astral-sh/uv/issues/6838

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-09-17 10:48:56 -05:00
Aria DesiresandZanie Blue 8917b00fd9 add docs for dependency group requires-python (#14282)
I specifically show more details than necessary in the example to make
it more clear that this is *NOT* the normal dependency-groups table.

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-09-12 13:15:27 +00:00
Aria Desires a42a2846e6 Make warnings about masked [tool.uv] fields more precise (#14325)
This is the second half of #14308
2025-07-20 18:54:50 -04:00
Aria DesiresandJohn Mumm 95c0b71f77 Remove uv version fallback (#14161)
Fixes #14157

---------

Co-authored-by: John Mumm <jtfmumm@gmail.com>
2025-07-17 17:20:21 -05:00
Aria DesiresandJohn Mumm 2850dc0599 make --check outdated a non-error status 1 (#14167)
In the case of `uv sync` all we really need to do is handle the
`OutdatedEnvironment` error (precisely the error we yield only on
dry-runs when everything Works but we determine things are outdated) in
`OperationDiagnostic::report` (the post-processor on all
`operations::install` calls) because any diagnostic handled by that gets
downgraded to from status 2 to status 1 (although I don't know if that's
really intentional or a random other bug in our status handling... but I
figured it's best to highlight that other potential status code
incongruence than not rely on it 😄).

Fixes #12603

---------

Co-authored-by: John Mumm <jtfmumm@gmail.com>
2025-07-17 17:20:21 -05:00
Aria Desires 9cf7821741 Add missing validations for disallowed uv.toml fields (#14322)
We weren't following our usual "destructure all the options" pattern in
this function, and several "this isn't actually read from uv.toml"
fields slipped through the cracks over time since folks forgot it
existed.

Fixes part of #14308, although we could still try to make the warning in
FilesystemOptions more accurate?

You could argue this is a breaking change, but I think it ultimately
isn't really, because we were already silently ignoring these fields.
Now we properly error.
2025-07-17 17:20:21 -05:00
34fbc06ad6 Add experimental uv sync --output-format json (#13689)
This is a continuation of the work in 

* #12405 

I have:
* moved to an architecture where the human output is derived from the
json structs to centralize more of the printing state/logic
* cleaned up some of the names/types
* added tests
* removed the restriction that this output is --dry-run only

I have not yet added package info, which was TBD in their design.

---------

Co-authored-by: x0rw <mahdi.svt5@gmail.com>
Co-authored-by: Zanie Blue <contact@zanie.dev>
Co-authored-by: John Mumm <jtfmumm@gmail.com>
2025-07-14 14:53:39 +00:00
Aria DesiresandZanie Blue 042df4a7de Expand the functionality of uv version --bump to support pre-releases (#13578)
This adds `alpha`, `beta`, `rc`, `stable`, `post`, and `dev` modes to
`uv version --bump`.

The components that `--bump` accepts are ordered as follows:

    major > minor > patch > stable > alpha > beta > rc > post > dev
    
Bumping a component "clears" all lesser component (`alpha`, `beta`, and
`rc` all overwrite each other):

* `--bump minor` on `1.2.3a4.post5.dev6` => `1.3.0`
* `--bump alpha` on `1.2.3a4.post5.dev6` => `1.2.3a5` 
* `--bump dev  ` on `1.2.3a4.post5.dev6` => `1.2.3a4.post5.dev7`

In addition, `--bump` can now be repeated. The primary motivation of
this is "bump stable version and also enter a prerelease", but it
technically lets you express other things if you want them:

* `--bump patch --bump alpha` on `1.2.3` => `1.2.4a1` ("bump patch
version and go to alpha 1")
* `--bump minor --bump patch` on `1.2.3` => `1.3.1` ("bump minor version
and got to patch 1")
* `--bump minor --bump minor` on `1.2.3` => `1.4.0` ("bump minor version
twice")

The `--bump` flags are sorted by their priority, so that you don't need
to remember the priority yourself. This ordering is the only "useful"
one that preserves every `--bump` you passed, so there's no concern
about loss of expressiveness. For instance `--bump minor --bump major`
would just be `--bump major` if we didn't sort, as the major bump clears
the minor version. The ordering of `beta` after `alpha` means `--bump
alpha --bump beta` will just result in beta 1; this is the one case
where a bump request will effectively get overwritten.

The `stable` mode "bumps to the next stable release", clearing the pre
(`alpha`, `beta`, `rc`), `dev`, and `post` components from a version
(`1.2.3a4.post5.dev6` => `1.2.3`). The choice to clear `post` here is a
bit odd, in that `1.2.3.post4` => `1.2.3` is actually a version
decrease, but I think this gives a more intuitive model (as preserving
`post5` in the previous example is definitely wrong), and also
post-releases are extremely obscure so probably no one will notice. In
the cases where this behaviour isn't useful, you probably wanted to pass
`--bump patch` or something anyway which *should* definitely clear the
`post5` (putting it another way: the only cases where `--bump stable`
has dubious behaviour is when you wanted it to do a noop, which, is a
command you could have just not written at all).

In all cases we preserve the "epoch" and "local" components of a
version, so the `7!` and `+local` in `7!1.2.3+local` will never be
modified by `--bump` (you can use the raw version set mode if you want
to touch those). The preservation of `local` is another slightly odd
choice, but it's a really obscure feature (so again it mostly won't come
up) and when it's used it seems to mostly be used for referring to
variant releases, in which case preserving it tends to be correct.

Fixes #13223

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-07-10 08:45:17 -05:00
Aria Desires 2f9061dcd0 Update python, add support for installing arm windows pythons (#14374) 2025-06-30 22:02:19 +00:00
Aria Desires 317ce6e245 disfavor aarch64 windows in its own house (#13724)
and prefer emulated x64 windows in its stead.

This is preparatory work for shipping support for uv downloading and
installing aarch64 (arm64) windows Pythons. We've [had builds for this
platform ready for a
while](https://github.com/astral-sh/python-build-standalone/pull/387),
but have held back on shipping them due to a fundamental problem:

**The Python packaging ecosystem does not have strong support for
aarch64 windows**, e.g., not many projects build aarch64 wheels yet. The
net effect of this is that, if we handed you an aarch64 python
interpreter on windows, you would have to build a lot more sdists, and
there's a high chance you will simply fail to build that sdist and be
sad.

Yes unfortunately, in this case a non-native Python interpreter simply
*works better* than the native one... in terms of working at all, today.
Of course, if the native interpreter works for your project, it should
presumably have better performance and platform compatibility.

We do not want to stand in the way of progress, as ideally this
situation is a temporary state of affairs as the ecosystem grows to
support aarch64 windows. To enable progress, on aarch64 Windows builds
of uv:

* We will still use a native python interpreter, e.g., if it's at the
front of your `PATH` or the only installed version.
* If we are choosing between equally good interpreters that differ in
architecture, x64 will be preferred.
* If the aarch64 version is newer, we will prefer the aarch64 one.
* We will emit a diagnostic on installation, and show the python request
to pass to uv to force aarch64 windows to be used.
* Will be shipping [aarch64 Windows Python
downloads](https://github.com/astral-sh/python-build-standalone/pull/387)
* Will probably add some kind of global override setting/env-var to
disable this behaviour.
* Will be shipping this behaviour in
[astral-sh/setup-uv](https://github.com/astral-sh/setup-uv)

We're coordinating with Microsoft, GitHub (for the `setup-python`
action), and the CPython team (for the `python.org` installers), to
ensure we're aligned on this default and the timing of toggling to
prefer native distributions in the future.

See discussion in 

- https://github.com/astral-sh/uv/issues/12906

---

This is an alternative to 

* #13719 

which uses sorting rather than filtering, as discussed in 

* #13721
2025-06-30 17:42:00 -04:00
Aria Desires 1e02008d8b add more proper docker login if (#14278) 2025-06-26 12:05:45 -04:00
Aria Desires e7f5967111 Don't block docker logins on it being a pull-request (#14222) 2025-06-23 13:30:49 -04:00
Aria Desires 92de53f4eb Bump version to 0.7.14 (#14218) 2025-06-23 12:48:51 -04:00
Aria Desires c710246d76 Update cargo-dist (#14156)
Also took the time to migrate to the external config format to normalize
our projects for team comfort (`ty` *has* to use this format for its
workspace structure).
2025-06-20 14:20:01 -04:00
Aria Desires ff9c2c35d7 Support reading dependency-groups from pyproject.tomls with no project (#13742)
(or legacy tool.uv.workspace).

This cleaves out a dedicated SourcedDependencyGroups type based on
RequiresDist but with only the DependencyGroup handling implemented.
This allows `uv pip` to read `dependency-groups` from pyproject.tomls
that only have that table defined, per PEP 735, and as implemented by
`pip`.

However we want our implementation to respect various uv features when
they're available:

* `tool.uv.sources`
* `tool.uv.index`
* `tool.uv.dependency-groups.mygroup.requires-python` (#13735)

As such we want to opportunistically detect "as much as possible" while
doing as little as possible when things are missing. The issue with the
old RequiresDist path was that it fundamentally wanted to build the
package, and if `[project]` was missing it would try to desperately run
setuptools on the pyproject.toml to try to find metadata and make a hash
of things.

At the same time, the old code also put in a lot of effort to try to
pretend that `uv pip` dependency-groups worked like `uv`
dependency-groups with defaults and non-only semantics, only to separate
them back out again. By explicitly separating them out, we confidently
get the expected behaviour.

Note that dependency-group support is still included in RequiresDist, as
some `uv` paths still use it. It's unclear to me if those paths want
this same treatment -- for now I conclude no.

Fixes #13138
2025-06-13 22:16:48 +00:00
Aria Desires 5021840919 Add [tool.uv.dependency-groups].mygroup.requires-python (#13735)
This allows you to specify requires-python on individual dependency-groups,
with the intended usecase being "oh my dev-dependencies have a higher
requires-python than my actual project".

This includes a large driveby move of the RequiresPython type to
uv-distribution-types to allow us to generate the appropriate markers at
this point in the code. It also migrates RequiresPython from
pubgrub::Range to version_ranges::Ranges, and makes several pub(crate)
items pub, as it's no longer defined in uv_resolver.

Fixes #11606
2025-06-13 22:04:13 +00:00
Aria Desires 49b450109b filter out riscv64 wheels before publishing to pypi (#14009)
An alternative to #14006
2025-06-13 09:57:04 -04:00
Aria Desires d8636a4088 Prefer the binary's version when checking if it's up to date (#13840)
Fixes #13741
2025-06-04 11:32:59 -04:00
Aria Desires 891fe524d9 update python build standalone, unblocklist linux updates (#13732) 2025-05-30 12:33:21 -04:00
Aria Desires 067b03cc9a Only show the first match per platform (and architecture) by default in uv python list (#13721)
This is an alternative to #13701
2025-05-29 17:38:44 -04:00
Aria DesiresandCharlie Marsh cd8171d2a1 Unwire PackageMetadata fields (#13635)
PackageMetadata, for whatever reason, does not have a mirrored Wire type
so it was easy to not realize that it contains markers that need to be
complexified.

Fixes #13614

---------

Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
2025-05-26 14:17:19 -04:00
Aria Desires 0ddcc19055 Bump version to 0.7.8 (#13629) 2025-05-23 19:13:28 -04:00
Aria Desires b93ce238a0 blocklist the linux cpython builds from 20250517 (#13617)
There is a runtime issue with some of these builds

Here is the testing I've seen (❌ has bug, ✅ works):

* uv version (pbs version)
  * ❌ uv 0.7.7 (pbs 20250521)
  * ❌ uv 0.7.6 (pbs 20250517)
  * ✅ uv 0.7.5 (pbs 20250409)
* os
  * ❌ linux
  * ✅ windows
* arch
  * ❌ x86_64
  * ✅ aarch64
* python version
  * ❌ 3.12
  * ❌ 3.13
  * ❌ 3.14

Fixes #13610
2025-05-23 18:15:16 -04:00
Aria Desires 8580b4bd2d Bump version to 0.7.7 (#13601) 2025-05-22 14:42:26 -04:00
Aria Desires 38884da9b9 make uv version lock and sync (#13317)
This adopts the logic from `uv remove` for locking and syncing, as the
scope of the changes made are ultimately similar. Unlike `uv remove`
there is no support for modifying PEP723 scripts, as these are not
versioned.

In doing this the `version` command gains a truckload of args for
configuring lock/sync behaviour. Presumably most of these are passed via
settings or env files, and not of particular concern.

The most interesting additions are:

* `--frozen`: makes `uv version` work ~exactly as it did before this PR
* `--locked`: errors if the lockfile is out of date
* `--no-sync`: updates the lockfile, but doesn't run the equivalent of
`uv sync`
* `--package name`: a convenience for referring to a package in the
workspace

Note that the existing `--dry-run` flag effectively implies `--frozen` for sets and bumps.

Fixes #13254
Fixes #13548
2025-05-21 09:46:09 -04:00
Aria Desires f91b4aeb66 hard error uv version for more cli flags (#13203) 2025-04-30 17:39:11 +00:00
Aria Desires f401d9ba8f change uv version to be an interface for project version reads and edits (#12349)
This is a reimplementation of #7248 with a new CLI interface.

The old `uv version` is now `uv self version` (also it has gained a
`--short` flag for parity).
The new `uv version` is now an interface for getting/setting the project
version.

To give a modicum of support for migration, if `uv version` is run and
we fail to find/read a `pyproject.toml` we will fallback to `uv self
version`. `uv version --project .` prevents this fallback from being
allowed.

The new API of `uv version` is as follows:

* pass nothing to read the project version
* pass a version to set the project version
* `--bump major|minor|patch` to semver-bump the project version
* `--dry-run` to show the result but not apply it
* `--short` to have the final printout contain only the final version
* `--output-format json` to get the final printout as json

```
$ uv version
myfast 0.1.0

$ uv version --bump major --dry-run
myfast 0.1.0 => 1.0.0

$ uv version 1.2.3 --dry-run
myfast 0.1.0 => 1.2.3

$ uv version 1.2.3
myfast 0.1.0 => 1.2.3

$ uv version  --short
1.2.3

$ uv version  --output-format json
{
  "package_name": "myfast",
  "version": "1.2.3",
  "commit_info": null
}
```

Fixes #6298
2025-04-29 16:37:00 -05:00
Aria Desires 318949ade6 Error on unknown dependency object specifiers (#12841)
This reverts commit dd788a0f47.

And relands #12811, for 0.7.0
2025-04-29 16:37:00 -05:00
Aria Desires eef3fc2215 update cargo-dist and enable ci checks (#12949)
Fixes #12881 
Potentially Fixes #12780
Prevents #12879
2025-04-17 19:32:56 -04:00
Aria DesiresandChris Lieb 041c7a5e63 Use suffix on uvx binary when searching for uv binary (#12923)
This is a rebased and updated version of #11925 based on my review (I
didn't have permission to push to their branch).

For posterity I've preserved their commits but my final commit
essentially rewrites the whole thing anyway.

Fixes #11637

---------

Co-authored-by: Chris Lieb <clieb@bitsighttech.com>
2025-04-16 14:52:09 -04:00
Aria Desires ff566a5006 make distability opt-in (#12885)
We have been claiming in our releases that we provide
archives/installers for uv-build, but we only upload it as a wheel to
pypi. This is because cargo-dist tries to be helpful and find all your
apps, but this scales poorly to large workspaces like ours, as stuff
like this slips in. So invert the default and make uv the only package
dist will see until we say otherwise.

See e.g. https://github.com/astral-sh/uv/releases/tag/0.6.14

Fixes #12883
2025-04-14 14:49:28 -04:00
Aria Desires cb9499c210 fix cargo-dist config (#12879)
This is a followup from #12865, which broke cargo dist plan.
2025-04-14 10:56:22 -04:00
Aria Desires dd788a0f47 Revert "feat: Error on dependency object specifier (#12811)" (#12840)
This reverts commit c117acf905.

This is a minor breaking change, to be relanded in 0.7.0.
2025-04-11 18:32:48 +00:00
Aria Desires 591bc34d84 display aliases for long and short args in the cli reference (#12824)
Fixes #12494

(I don't feel like showing it in long-help matters too much...)
2025-04-10 16:36:22 -05:00
Aria Desires 713c0053ef fix link to issue (#12823)
Also closes #12641
2025-04-10 16:23:33 -04:00
Aria Desires 876b9aef50 update cargo-dist (#12790)
Putting this up to confirm that it does what it should:

* undirty the release.yml by including action-commits in the config
* add `persist-credentials=false` hardening
* includes but does not use `[package.metadata.dist.binaries]` overrides
(for #11786)
2025-04-10 09:42:41 -04:00
Aria Desires c0ed5693a7 only warn if CRC appears to be missing (#12722)
an alternative to #12706 

fixes #12694
2025-04-07 12:49:05 -05:00
Aria Desires ba443fae75 use astral-sh/cargo-dist instead (#12659) 2025-04-03 17:25:18 -04:00
Aria Desires 992f54ec17 improve archive error messages (#12627) 2025-04-02 15:57:00 +00:00
Aria Desires 9eaa9f789b enforce crc32 checks when using async-zip (#12623)
Fixes #12618 

Instead of succeeding the user now gets:

```
uvdloc pip install osqp==1.0.2 --reinstall --python-platform=linux
Resolved 7 packages in 171ms
  × Failed to download `osqp==1.0.2`
  ├─▶ Failed to extract archive
  ╰─▶ a computed CRC32 value did not match the expected value
```

I am not entirely sure if we have infra for testing this kind of thing,
but it would be nice to check in a test or two. I'm also not entirely
clear if there's any cases where these checks are overzealous.
2025-04-02 15:21:25 +00:00
Aria Desires c6e6478f66 fix parsing of python-platform in settings tomls (#12592)
serde needs to be told where to put underscores. someone clearly noticed
this when adding attributes for schemars, but they need to be present
for serde too and then schemars gets them for free.

Strictly speaking this would be a breaking change for anyone who noticed
the parsing was messed up and worked around it. So we add aliases for
backcompat, at least for a few releases.

Fixes #12590
2025-04-01 09:08:35 -04:00
Aria Desires 6c57c90ed3 distinguish -q and -qq (#12300)
The idea here is that we introduce a new stdout_important method for
things that want to care about the difference between "quiet" and
"silent".

This PR is WIP because it has no actual uses of stdout_important, and we
should have at least one before landing this. Perhaps someone has a
suggestion for commands that would really benefit from this distinction?

Fixes #10431
2025-03-26 16:46:16 -04:00
Aria DesiresandZanie Blue 26d40cb8a5 Restore "Support python find --script (#11891)"
Let's see if this reproduces in a PR now...

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-03-21 10:31:43 -05:00
Aria Desires 4eb7ab27ab Revert "Support python find --script (#11891)" (#12364)
This reverts commit b128aa0499 (#11891)

It *seems* like it's causing several tests to fail on linux?
2025-03-21 09:22:38 -04:00
Aria DesiresandZanie Blue 26cad18635 add default-groups = "all" sugar to pyproject.toml (#12289)
Suggested by @zanieb in #10934

* [x] agree we want to do this
* [x] add docs

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-03-18 13:42:06 -05:00
Aria Desires 43966f57ab update ring (#12295)
This resolves https://github.com/astral-sh/uv/security/dependabot/340
which doesn't meaningfully affect us but dependabot is screaming about
it nonetheless.
2025-03-18 14:24:51 -04:00
Aria Desires ada1acb32f Make cache errors non-fatal in Planner::build (#12281)
Same basic approach as #11105, including a cache version bump.

Fixes #12274
2025-03-18 11:27:21 -04:00
Aria Desires ba73231164 add pip-compatible --group flag to uv pip install and uv pip compile (#11686)
This is a minimal redux of #10861 to be compatible with `uv pip`.

This implements the interface described in:
https://github.com/pypa/pip/pull/13065#issuecomment-2544000876 for `uv
pip install` and `uv pip compile`. Namely `--group <[path:]name>`, where
`path` when not defined defaults to `pyproject.toml`.

In that interface they add `--group` to `pip install`, `pip download`,
and `pip wheel`. Notably we do not define `uv pip download` and `uv pip
wheel`, so for parity we only need to implement `uv pip install`.
However, we also support `uv pip compile` which is not part of pip
itself, and `--group` makes sense there too.

----

The behaviour of `--group` for `uv pip` commands makes sense for the
cases upstream pip supports, but has confusing meanings in cases that
only we support (because reading pyproject.tomls is New Tech to them but
heavily supported by us). **Specifically case (h) below is a concerning
footgun, and case (e) below may get complaints from people who aren't
well-versed in dependency-groups-as-they-pertain-to-wheels.**


## Only Group Flags

Group flags on their own work reasonably and uncontroversially, except
perhaps that they don't do very clever automatic project discovery.

a) `uv pip install --group path/to/pyproject.toml:mygroup` pulls up
`path/to/project.toml` and installs all the packages listed by its
`mygroup` dependency-group (essentially treating it like another kind of
requirements.txt). In this regard it functions similarly to
`--only-group` in the rest of uv's interface.

b) `uv pip install --group mygroup` is just sugar for `uv pip install
--group pyproject.toml:mygroup` (**note that no project discovery
occurs**, upstream pip simply hardcodes the path "pyproject.toml" here
and we reproduce that.)

c) `uv pip install --group a/pyproject.toml:groupx --group
b/pyproject.toml:groupy`, and any other instance of multiple `--group`
flags, can be understood as completely independent requests for the
given groups at the given files.


## Groups With Named Packages

Groups being mixed with named packages also work in a fairly
unsurprising way, especially if you understand that things like
dependency-groups are not really supposed to exist on pypi, they're just
for local development.

d) `uv pip install mypackage --group path/to/pyproject.toml:mygroup`
much like multiple instances of `--group` the two requests here are
essentially completely independent: pleases install `mypackage`, and
please also install `path/to/pyproject.toml:mygroup`.

e) `uv pip install mypackage --group mygroup` is exactly the same, but
this is where it becomes possible for someone to be a little confused,
as you might think `mygroup` is supposed to refer to `mypackage` in some
way (it can't). But no, it's sourcing `pyproject.toml:mygroup` from the
current working directory.


## Groups With Requirements/Sourcetrees/Editables

Requirements and sourcetrees are where I expect users to get confused.
It behaves *exactly* the same as it does in the previous sections but
you would absolutely be forgiven for expecting a different behaviour.
*Especially* because `--group` with the rest of uv *does* do something
different.

f) `uv pip install -r a/pyproject.toml --group b/pyproject.toml:mygroup`
is again just two independent requests (install `a/pyproject.toml`'s
dependencies, and `b/pyproject.toml`'s `mygroup`).

g) `uv pip install -r pyproject.toml --group mygroup` is exactly like
the previous case but *incidentally* the two requests refer to the same
file. What the user wanted to happen is almost certainly happening, but
they are likely getting "lucky" here that they're requesting something
simple.

h) `uv pip install -r a/pyproject.toml --group mygroup` is again exactly
the same but the user is likely to get surprised and upset as this
invocation actually sources two different files (install
`a/pyproject.toml`'s dependencies, and `pyproject.toml`'s `mygroup`)! I
would expect most people to assume the `--group` flag here is covering
all applicable requirements/sourcetrees/editables, but no, it continues
to be a totally independent reference to a file with a hardcoded
relative path.

------

Fixes https://github.com/astral-sh/uv/issues/8590
Fixes https://github.com/astral-sh/uv/issues/8969
2025-03-17 14:44:11 -04:00
Aria Desires 7acdbf6414 rework log verbosity (-vvv) (#11758)
Reworks how log verbosity flags work.

* `<no argument>` is the same, equivalent to `RUST_LOG=off`
* `-v` is the same, equivalent to `RUST_LOG=uv=debug`
* `-vv` is now equivalent to `RUST_LOG=uv=trace` (previously it only
enabled more log message context)
* `-vvv` is now equivalent to `RUST_LOG=trace` (previously it was
equivalent to `-vv`)

The "more context" that `-vv` had has been moved to an orthogonal
setting via an environment variable. Setting `UV_LOG_CONTEXT=1` will add
the extra context that `-vv` did.

In the future we may make these more granular as we try to use
`info!/warn!` more.

Fixes #1569
2025-02-28 18:49:27 -05:00
Aria Desires a0b9f22a21 Bump version to 0.6.3 (#11759) 2025-02-24 17:25:01 -05:00
Aria Desires f394f72453 respect color settings for log messages (#11604)
fixes #11560
2025-02-18 15:39:28 -05:00
Aria DesiresandZanie Blue fbe9e33b8d Note that main.py used to be hello.py (#11519)
Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-02-14 21:59:25 +00:00
Aria Desires 9138b35c66 Create main.py instead of hello.py in uv init (#10369)
Initially it seemed like `app.py` might be slightly more desirable but
people seem to overwhelmingly favour `main.py` as a good "generic" name.

Fixes #7782
2025-02-13 16:17:49 -06:00
Aria Desires f682c9b374 regenerate snapshots 2025-02-13 16:17:49 -06:00
Aria Desires 49e10435f1 add provides-extras to lockfile (#11063)
Fixes #10953
2025-02-13 16:17:49 -06:00
ba5efa8aa4 retry local clones without hardlinks if they fail (#11421)
Fixes #11420

---------

Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
Co-authored-by: Filippo Vicentini <filippovicentini@gmail.com>
2025-02-11 19:42:13 -05:00
Aria DesiresandZanie Blue 161eb42cb9 don't use the Cool popup-generating eprintln in trampoline for warnings (#11295)
Also I refactored the code a bit to centralize all the calls of
eprintln.

Fixes #10706

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
2025-02-07 13:33:12 -05:00
Aria Desires 5c4b6d436c cleanup some dependency-group docs (#11284)
Some additional details, more mentioning of related flags, and some
minor rewordings to avoid misconceptions I had from the current docs.

Closes #11205
2025-02-07 15:40:59 +00:00
Aria Desires 72d9361ce1 fix handling of --all-groups and --no-default-groups flags (#11224)
This is a rewrite of the groups subsystem to have more clear semantics,
and some adjustments to the CLI flag constraints. In doing so, the
following bugs are fixed:

* `--no-default-groups --no-group foo` is no longer needlessly rejected
* `--all-groups --no-default-groups` now correctly evaluates to
`--all-groups` where previously it was erroneously being interpretted as
just `--no-default-groups`
* `--all-groups --only-dev` is now illegal, where previously it was
accepted and mishandled, as if it was a mythical `--only-all-groups`
flag

Fixes #10890
Closes #10891
2025-02-05 15:31:23 -05:00
Aria Desires a2db48d649 fix async windows file persist retries (#11008)
The previous two versions of the code were bugged and would always
produce None when you retried (producing a hard LostState error).
2025-01-27 18:51:36 -05:00
Aria Desires c05aca61db temporarily disable new uv pip dependency-group flags (#10909)
We'll probably end up shipping but we were moving ahead with this on the
basis that pip may not even ship this, so let's play it safe and wait
for a bit.
2025-01-23 14:43:07 -06:00
Aria Desires 86f2f16d05 make test filter permissive of bdist.win32 (#10911)
I swear a few days ago there were way more of this filter but now
there's only one so *shrug*.
2025-01-23 14:13:00 -05:00
Aria Desires 214494149c fix --only-group in uv pip interface (#10902)
This was an oversight in the implementation, thankfully it appears to be
a simple fix? (My only hesitation is this implementation essentially
claims that --only-group is defacto incompatible with --extra and I
*think* that's the case but I'm not certain.)
2025-01-23 11:35:47 -05:00
Aria Desires 53706a1864 Add dependency-group cli flags to uv pip install and uv pip compile (--group, --no-group, --only-group, --all-groups) (#10861)
Ultimately this is a lot of settings plumbing and a couple minor pieces
of Actual Logic (which are so simple I have to assume there's something
missing, but maybe not!).

Note this "needlessly" use DevDependencyGroup since it costs nothing, is
more futureproof, and lets us maintain one primary interface (we just
pass `false` for all the dev arguments).

Fixes #8590
Fixes #8969
2025-01-23 08:47:52 -05:00
Aria Desires 80ac8db7db Always spawn a main2 thread to normalize main stack size issues (#10479)
Also removes UV_STACK_SIZE and uses RUST_MIN_STACK instead, tweaking
docs to reflect the differences.

Fixes #10367
2025-01-14 22:35:17 -05:00
Aria DesiresandJohn Zlotek 692171c718 add --output-format=json flag to uv python list (#10596)
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:

- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->

## Summary

I use `uv` for automation on remote hosts and it would be useful to have
it be able to tell me the supported versions of python (for the remote
machine) in a machine readable manner so I do not need to parse `uv
python list`.

This change adds `--format (json|text)` to `uv python list` to make it's
output machine readable

Loosely related:

- https://github.com/astral-sh/uv/issues/411

## Test Plan

Manually tested via

```
# quick inspection without pretty print
cargo run -- python list --format json
```

### Short example of output (trimmed down)

Cmd: `cargo run -- python list --format json | jq '.[:2]'`

```json
[
  {
    "key": "cpython-3.13.1+freethreaded-linux-x86_64-gnu",
    "version": "3.13.1",
    "version_parts": {
      "major": 3,
      "minor": 13,
      "patch": 1
    },
    "path": null,
    "symlink": null,
    "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20241219/cpython-3.13.1%2B20241219-x86_64-unknown-linux-gnu-freethreaded%2Bpgo%2Blto-full.tar.zst",
    "os": "linux",
    "variant": "freethreaded",
    "implementation": "cpython",
    "arch": "x86_64",
    "libc": "gnu"
  },
  {
    "key": "cpython-3.13.1-linux-x86_64-gnu",
    "version": "3.13.1",
    "version_parts": {
      "major": 3,
      "minor": 13,
      "patch": 1
    },
    "path": "/usr/bin/python3.13",
    "symlink": null,
    "url": null,
    "os": "linux",
    "variant": "default",
    "implementation": "cpython",
    "arch": "x86_64",
    "libc": "gnu"
  }
]
```

---------

Co-authored-by: John Zlotek <jzlotek@gmail.com>
2025-01-14 11:47:49 -05:00
Aria Desires e2c5526fbb replace backoff with backon (#10442)
This should be essentially the exact same behaviour, but backon is a
total API redesign, so things had to be expressed slightly differently.
Overall I think the code is more readable, which is nice.

Fixes #10001
2025-01-09 16:01:23 -05:00
Aria Desires 2f7f9ea571 improve shell compatibility of venv activate scripts (#10397)
The shellcheck action we uses misses some files, so they fell out of
spec for what we support. This PR first and foremost adds them to the
scanning list, and then fixes the issues found.

Fixes #7480
2025-01-08 13:12:29 -05:00