astral-sh-uv

mirror of https://github.com/astral-sh/uv synced 2026-06-21 13:47:25 +00:00

Files

T

History

zaniebot 1a1a801a1e Reject invalid UTF-8 URL credentials (#19814 )

## Summary

- make URL credential extraction fallible
- reject percent-decoded usernames and passwords that are not valid
UTF-8
- propagate credential decoding errors through index, Git, project,
publish, and HTTP client paths
- identify failing indexes with their display-safe URL
- add unit and end-to-end regression coverage

## Why

Lossy decoding replaced malformed bytes with U+FFFD, silently changing
the credential sent on the wire and collapsing distinct inputs. URL
parsing remains permissive; the error is raised only when converting URL
userinfo into uv's string credential model.

Follow-up to
https://github.com/astral-sh/uv/pull/19800#discussion_r3398777727.

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>

2026-06-11 18:01:29 -05:00

httpcache

Reduce scope of public interfaces (#19460 )

2026-05-18 16:14:56 -07:00

base_client.rs

Reject invalid UTF-8 URL credentials (#19814 )

2026-06-11 18:01:29 -05:00

cached_client.rs

Avoid overflow when reading malformed cache entries (#19799 )

2026-06-11 16:31:42 +00:00

error.rs

Remove unused pub code from workspace (#19565 )