Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: astral-sh/uv
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 0.11.13
Choose a base ref
...
head repository: astral-sh/uv
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 0.11.14
Choose a head ref
  • 16 commits
  • 182 files changed
  • 10 contributors

Commits on May 11, 2026

  1. Fix uv tree showing extra-conditional deps for packages required wi… 

    …thout extras (#19332)

When a package is required both as a plain dependency and as
`pkg[extra]` in a group, `uv tree` can show the extra's dependencies
under the plain occurrence too. This updates `TreeDisplay::visit` to
only traverse optional outgoing edges when the incoming edge actually
activates the matching extra, while leaving `--invert` unchanged since
the edge direction is reversed there.

Added `dep_and_group_extras` in `crates/uv/tests/it/tree.rs`. All
existing tree tests pass.

Closes #19327

---------

Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>
    @nooscraft @charliermarsh
    nooscraft and charliermarsh authored May 11, 2026
    Configuration menu
    Copy the full SHA
    4d6ca8d View commit details
    Browse the repository at this point in the history

  2. Update Rust crate reqwest to v0.13.3 (#19348) 

    This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [reqwest](https://redirect.github.com/seanmonstar/reqwest) |
workspace.dependencies | patch | `0.13.2` → `0.13.3` |

---

### Release Notes

<details>
<summary>seanmonstar/reqwest (reqwest)</summary>

###
[`v0.13.3`](https://redirect.github.com/seanmonstar/reqwest/blob/HEAD/CHANGELOG.md#v0133)

[Compare
Source](https://redirect.github.com/seanmonstar/reqwest/compare/v0.13.2...v0.13.3)

- Fix CertificateRevocationList parsing of PEM values.
- Fix logging in resolver to only show host, not full URL.
- Fix hickory-dns to fallback to a default if `/etc/resolv.conf` fails.
- Fix HTTP/3 to handle `STOP_SENDING` as not an error.
- Fix HTTP/3 pool to remove timed out QUIC connections.
- Fix HTTP/3 connection establishment picking IPv4 and IPv6.
- Upgrade rustls-platform-verifier.
- (wasm) Only use wasm-bindgen on unknown-\* targets.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJidWlsZDpza2lwLWRvY2tlciIsImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
    @renovate
    renovate[bot] authored May 11, 2026
    Configuration menu
    Copy the full SHA
    d61b337 View commit details
    Browse the repository at this point in the history

  3. Update CodSpeedHQ/action action to v4.15.0 (#19350) 

    This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | minor | `v4.14.0` → `v4.15.0` | `v4.15.1` |

---

### Release Notes

<details>
<summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary>

###
[`v4.15.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.15.0)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.14.0...v4.15.0)

#### Release Notes

This release adds first support for macOS walltime.

Please note that profiling and other instruments are not yet available
on macOS and will come in a later update.

##### Minimum integration versions

- [`pytest-codspeed`
v4.5.0](https://redirect.github.com/CodSpeedHQ/pytest-codspeed/releases/tag/v4.5.0)
- [`codspeed-rust`
v4.6.0](https://redirect.github.com/CodSpeedHQ/codspeed-rust/releases/tag/v4.6.0)
- [`codspeed-cpp`
v2.3.0](https://redirect.github.com/CodSpeedHQ/codspeed-cpp/releases/tag/v2.3.0)
- [`codspeed-go`
v1.2.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.2.0)
- [`codspeed-node`
v5.4.0](https://redirect.github.com/CodSpeedHQ/codspeed-node/releases/tag/v5.4.0)

##### <!-- 0 -->🚀 Features

- Revert logo changes by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
- Display N/A rather than NaN/inf in the benchmarks results table by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&#8203;314](https://redirect.github.com/CodSpeedHQ/runner/pull/314)
- Only wrap walltime command with sudo on linux by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
- Add `--with-token` flag to read token from stdin by
[@&#8203;fargito](https://redirect.github.com/fargito) in
[#&#8203;313](https://redirect.github.com/CodSpeedHQ/runner/pull/313)
- Warn when libc debug info is not found by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;310](https://redirect.github.com/CodSpeedHQ/runner/pull/310)
- Resolve debug info and symbols from separate debug files by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;303](https://redirect.github.com/CodSpeedHQ/runner/pull/303)

##### <!-- 6 -->🧪 Testing

- Add libc debuglink/build-id fixtures by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias)
- Add stripped binary and debug file test fixtures by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias)

##### <!-- 7 -->⚙️ Internals

- chore: bump runner version to 4.15.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&#8203;204](https://redirect.github.com/CodSpeedHQ/action/pull/204)
- Bump exec-harness version
- Add macos basic run test by
[@&#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&#8203;319](https://redirect.github.com/CodSpeedHQ/runner/pull/319)
- Remove DumpPerfMapAtExit in favor of custom dumper by
[@&#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&#8203;295](https://redirect.github.com/CodSpeedHQ/runner/pull/295)

#### Install codspeed-runner 4.15.0

##### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.15.0/codspeed-runner-installer.sh | sh
```

#### Download codspeed-runner 4.15.0

| File | Platform | Checksum |
|
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
| ------------------- |
-------------------------------------------------------------------------------------------------------------------------------------
|
|
[codspeed-runner-aarch64-apple-darwin.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.15.0/codspeed-runner-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.15.0/codspeed-runner-aarch64-apple-darwin.tar.gz.sha256)
|
|
[codspeed-runner-aarch64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.15.0/codspeed-runner-aarch64-unknown-linux-musl.tar.gz)
| ARM64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.15.0/codspeed-runner-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[codspeed-runner-x86\_64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.15.0/codspeed-runner-x86_64-unknown-linux-musl.tar.gz)
| x64 MUSL Linux |
[checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.15.0/codspeed-runner-x86_64-unknown-linux-musl.tar.gz.sha256)
|

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

**Full Changelog**:
<CodSpeedHQ/action@v4.14.0...v4.15.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJidWlsZDpza2lwLWRvY2tlciIsImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
    @renovate
    renovate[bot] authored May 11, 2026
    Configuration menu
    Copy the full SHA
    a56dd74 View commit details
    Browse the repository at this point in the history

  4. Encapsulate fastid APIs in their type (#19328) 

    ## Summary

This was purely an oversight from #19201 -- `Id::{secure,insecure}` is
what I meant to do for ctors, instead of having these float on the
module itself.

## Test Plan

NFC, no public changes.

Signed-off-by: William Woodruff <william@yossarian.net>
    @woodruffw
    woodruffw authored May 11, 2026
    Configuration menu
    Copy the full SHA
    f3185e4 View commit details
    Browse the repository at this point in the history

  5. Update dependency astral-sh/uv to v0.11.13 (#19354) 

    This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/uv](https://redirect.github.com/astral-sh/uv) | uses-with |
patch | `0.11.12` → `0.11.13` |

---

### Release Notes

<details>
<summary>astral-sh/uv (astral-sh/uv)</summary>

###
[`v0.11.13`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01113)

[Compare
Source](https://redirect.github.com/astral-sh/uv/compare/0.11.12...0.11.13)

Released on 2026-05-10.

##### Bug fixes

- Include data files in editable builds
([#&#8203;19312](https://redirect.github.com/astral-sh/uv/pull/19312))
- Respect `--require-hashes` when installing from `pylock.toml` files
([#&#8203;19334](https://redirect.github.com/astral-sh/uv/pull/19334))

##### Python

- Add CPython 3.14.5

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJidWlsZDpza2lwLWRvY2tlciIsImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
    @renovate
    renovate[bot] authored May 11, 2026
    Configuration menu
    Copy the full SHA
    248ad8a View commit details
    Browse the repository at this point in the history

  6. Update crate-ci/typos action to v1.46.0 (#19351) 

    This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [crate-ci/typos](https://redirect.github.com/crate-ci/typos) | action
| minor | `v1.45.1` → `v1.46.0` | `v1.46.1` |

---

### Release Notes

<details>
<summary>crate-ci/typos (crate-ci/typos)</summary>

###
[`v1.46.0`](https://redirect.github.com/crate-ci/typos/releases/tag/v1.46.0)

[Compare
Source](https://redirect.github.com/crate-ci/typos/compare/v1.45.2...v1.46.0)

#### \[1.46.0] - 2026-04-30

##### Features

- Updated the dictionary with the [April
2026](https://redirect.github.com/crate-ci/typos/issues/1531) changes

###
[`v1.45.2`](https://redirect.github.com/crate-ci/typos/releases/tag/v1.45.2)

[Compare
Source](https://redirect.github.com/crate-ci/typos/compare/v1.45.1...v1.45.2)

##### \[1.45.2] - 2026-04-27

##### Fixes

- Ignore ssh
[`ed25519`](https://redirect.github.com/crate-ci/typos/commit/ed25519)
public keys

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJidWlsZDpza2lwLWRvY2tlciIsImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
    @renovate
    renovate[bot] authored May 11, 2026
    Configuration menu
    Copy the full SHA
    2b0def7 View commit details
    Browse the repository at this point in the history

  7. Avoid applying .env files in parent process (#19343) 

    ## Summary

Our support for `.env` files is intended to be limited to the process we
execute in `uv run` or `uv tool run` (or `uvx`), i.e., we don't intend
to support setting uv-specific environment variables via `.env`. As-is,
though, some environment variables like `UV_TOOL_DIR` _can_ be set due
to order of operations. This PR modifies our loading to avoid reading
the `.env` into the parent process. Instead, we use `dotenvy` to read
the values, but set them explicitly on the child process.

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
    @charliermarsh @zanieb
    charliermarsh and zanieb authored May 11, 2026
    Configuration menu
    Copy the full SHA
    9f21ff8 View commit details
    Browse the repository at this point in the history

  8. Update Rust crate junction to v2 (#19353) 

    Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: William Woodruff <william@yossarian.net>
    @renovate @woodruffw
    renovate[bot] and woodruffw authored May 11, 2026
    Configuration menu
    Copy the full SHA
    81e7f8c View commit details
    Browse the repository at this point in the history

  9. Filter ANSI codes in logging output (#19311)

    @woodruffw
    woodruffw authored May 11, 2026
    Configuration menu
    Copy the full SHA
    b2bd71a View commit details
    Browse the repository at this point in the history

  10. Ensure publish to crates.io is idempotent (#19361) 

    Co-authored-by: Codex <noreply@openai.com>
    @zanieb @codex
    zanieb and codex authored May 11, 2026
    Configuration menu
    Copy the full SHA
    96b43af View commit details
    Browse the repository at this point in the history

  11. Fix JUnit upload on Windows runners (#19370) 

    ## Summary

This was an oversight from #19330. We're running our tests on Windows in
a Dev Drive, so we need to fixup the path rather than assuming that CWD
has a `target` dir.

## Test Plan

NFC.

Signed-off-by: William Woodruff <william@yossarian.net>
    @woodruffw
    woodruffw authored May 11, 2026
    Configuration menu
    Copy the full SHA
    374fcaa View commit details
    Browse the repository at this point in the history

  12. Ignore top_level.txt entries in uninstall that are not valid Python… 

    … identifiers (#19340)

## Summary

In eggs, `top_level.txt` contains top-level import names, not paths.
setuptools documents the file as [one Python identifier per
line](https://setuptools.pypa.io/en/stable/deprecated/python_eggs.html#top-level-txt-conflict-management-metadata).

This PR updates the egg uninstall process to reject `top_level.txt`
entries that are not valid Python identifiers (before joining them
against site-packages for deletion). That prevents malformed entries
like `../../target` or absolute paths from deleting files outside the
package’s valid top-level modules.
    @charliermarsh
    charliermarsh authored May 11, 2026
    Configuration menu
    Copy the full SHA
    685c32c View commit details
    Browse the repository at this point in the history

Commits on May 12, 2026

  1. Add Astral mirror URL override (#19206) 

    Support UV_ASTRAL_MIRROR_URL for mirrored Astral release metadata and
artifacts, including Ruff, CPython downloads, and self-update. When set,
no GitHub fallback takes place. The more specific env vars override
this.

Closes #9134
Closes #16519
Closes #17255
Closes #15970
Closes #18525
    @zsol
    zsol authored May 12, 2026
    Configuration menu
    Copy the full SHA
    7d65903 View commit details
    Browse the repository at this point in the history

  2. Respect build options (e.g., --no-build) during lock validation (#1… 

    …9366)

## Summary

Right now, `--no-build` et al are ignored during lockfile validation.
This PR wires them up, and improves lockfile validation to reuse static
metadata in one case that was surfaced by the change.
    @charliermarsh
    charliermarsh authored May 12, 2026
    Configuration menu
    Copy the full SHA
    601c2b8 View commit details
    Browse the repository at this point in the history

  3. Document uv auth helper for Bazel credential helper use (#19358)

    @zsol
    zsol authored May 12, 2026
    Configuration menu
    Copy the full SHA
    634b03f View commit details
    Browse the repository at this point in the history

  4. Bump version to 0.11.14 (#19377) 

    Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Zanie Blue <contact@zanie.dev>
    @github-actions @zanieb
    3 people authored May 12, 2026
    Configuration menu
    Copy the full SHA
    3fdfdc7 View commit details
    Browse the repository at this point in the history
Loading