Prevent uv tool upgrade from installing excluded dependencies by gizmoguy · Pull Request #18022 · astral-sh/uv

gizmoguy · 2026-02-15T04:16:25Z

Summary

Store dependencies excluded by uv tool install in the tool receipt and provide these same dependencies to the requirements resolver when the tool is upgraded.

Test Plan

Running the repro commands provided in issue #18021, we can see the excluded dependency does not get reinstalled when the tool is upgraded:

$ cat /tmp/excludes.txt
markdown-it-py

$ ~/Dev/uv/target/debug/uv install --excludes /tmp/excludes.txt 2048-cli==1.0.2
Resolved 7 packages in 150ms
Installed 7 packages in 56ms
 + 2048-cli==1.0.2
 + click==8.3.1
 + maturin==1.12.0
 + numpy==2.4.2
 + pygments==2.19.2
 + rich==13.9.4
 + rich-menu==0.3.0
Installed 1 executable: 2048-cli

$ cat ~/.local/share/uv/tools/2048-cli/uv-receipt.toml
[tool]
requirements = [{ name = "2048-cli" }]
excludes = ["markdown-it-py"]
entrypoints = [
    { name = "2048-cli", install-path = "/home/brad/.local/bin/2048-cli", from = "2048-cli" },
]

$ ~/Dev/uv/target/debug/uv tool upgrade 2048-cli
Updated 2048-cli v1.0.2 -> v1.0.3
 - 2048-cli==1.0.2
 + 2048-cli==1.0.3
Installed 1 executable: 2048-cli

zanieb · 2026-02-15T17:47:45Z

crates/uv/src/commands/tool/upgrade.rs

+    // Add excludes from tool receipt to requirements
+    spec.excludes = existing_tool_receipt.excludes().to_vec();


I think we should instead add a function like from_excludes like from_overrides that includes this.

We'll need to open a separate ticket to revisit / improve that API design.

We also might need to open a ticket to add excludes support to scripts?

uv/crates/uv/src/commands/project/mod.rs

Line 2707 in d2ab2d0

pub(crate) fn script_specification(

does not use it?

I think we should instead add a function like from_excludes like from_overrides that includes this.

We'll need to open a separate ticket to revisit / improve that API design.

Would adding an excludes argument to from_overrides() be an acceptable solution for this PR?

For the moment script_specification() would supply an empty Vec for this argument and this could be later populated when it gains support for dependency exclusion.

(Added a method.)

zanieb · 2026-02-15T17:49:10Z

This change should have new test coverage

Store dependencies excluded by uv tool install in the tool receipt and provide these same dependencies to the requirements resolver when the tool is upgraded.

gizmoguy · 2026-02-16T05:47:24Z

This change should have new test coverage

I've added an appropriate test to 1779efd

## Summary See: #18022 (comment).

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [uv](https://github.com/astral-sh/uv) | patch | `0.10.7` → `0.10.9` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.10.9`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0109) [Compare Source](astral-sh/uv@0.10.8...0.10.9) Released on 2026-03-06. ##### Enhancements - Add `fbgemm-gpu`, `fbgemm-gpu-genai`, `torchrec`, and `torchtune` to the PyTorch list ([#18338](astral-sh/uv#18338)) - Add torchcodec to PyTorch List ([#18336](astral-sh/uv#18336)) - Log the duration we took before erroring ([#18231](astral-sh/uv#18231)) - Warn when using `uv_build` settings without `uv_build` ([#15750](astral-sh/uv#15750)) - Add fallback to `/usr/lib/os-release` on Linux system lookup failure ([#18349](astral-sh/uv#18349)) - Use `cargo auditable` to include SBOM in uv builds ([#18276](astral-sh/uv#18276)) ##### Configuration - Add an environment variable for `UV_VENV_RELOCATABLE` ([#18331](astral-sh/uv#18331)) ##### Performance - Avoid toml `Document` overhead ([#18306](astral-sh/uv#18306)) - Use a single global workspace cache ([#18307](astral-sh/uv#18307)) ##### Bug fixes - Continue on trampoline job assignment failures ([#18291](astral-sh/uv#18291)) - Handle the hard link limit gracefully instead of failing ([#17699](astral-sh/uv#17699)) - Respect build constraints for workspace members ([#18350](astral-sh/uv#18350)) - Revalidate editables and other dependencies in scripts ([#18328](astral-sh/uv#18328)) - Support Python 3.13+ on Android ([#18301](astral-sh/uv#18301)) - Support `cp3-none-any` ([#17064](astral-sh/uv#17064)) - Skip tool environments with broken links to Python on Windows ([#17176](astral-sh/uv#17176)) ##### Documentation - Add documentation for common marker values ([#18327](astral-sh/uv#18327)) - Improve documentation on virtual dependencies ([#18346](astral-sh/uv#18346)) ### [`v0.10.8`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0108) [Compare Source](astral-sh/uv@0.10.7...0.10.8) Released on 2026-03-03. ##### Python - Add CPython 3.10.20 - Add CPython 3.11.15 - Add CPython 3.12.13 ##### Enhancements - Add Docker images based on Docker Hardened Images ([#18247](astral-sh/uv#18247)) - Add resolver hint when `--exclude-newer` filters out all versions of a package ([#18217](astral-sh/uv#18217)) - Configure a real retry minimum delay of 1s ([#18201](astral-sh/uv#18201)) - Expand `uv_build` direct build compatibility ([#17902](astral-sh/uv#17902)) - Fetch CPython from an Astral mirror by default ([#18207](astral-sh/uv#18207)) - Download uv releases from an Astral mirror in installers by default ([#18191](astral-sh/uv#18191)) - Add SBOM attestations to Docker images ([#18252](astral-sh/uv#18252)) - Improve hint for installing meson-python when missing as build backend ([#15826](astral-sh/uv#15826)) ##### Configuration - Add `UV_INIT_BARE` environment variable for `uv init` ([#18210](astral-sh/uv#18210)) ##### Bug fixes - Prevent `uv tool upgrade` from installing excluded dependencies ([#18022](astral-sh/uv#18022)) - Promote authentication policy when saving tool receipts ([#18246](astral-sh/uv#18246)) - Respect exclusions in scripts ([#18269](astral-sh/uv#18269)) - Retain default-branch Git SHAs in `pylock.toml` files ([#18227](astral-sh/uv#18227)) - Skip installed Python check for URL dependencies ([#18211](astral-sh/uv#18211)) - Respect constraints during `--upgrade` ([#18226](astral-sh/uv#18226)) - Fix `uv tree` orphaned roots and premature deduplication ([#17212](astral-sh/uv#17212)) ##### Documentation - Mention cooldown and tweak inline script metadata in dependency bots documentation ([#18230](astral-sh/uv#18230)) - Move cache prune in GitLab to `after_script` ([#18206](astral-sh/uv#18206)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

zanieb reviewed Feb 15, 2026

View reviewed changes

Prevent uv tool upgrade from installing excluded dependencies

1779efd

Store dependencies excluded by uv tool install in the tool receipt and provide these same dependencies to the requirements resolver when the tool is upgraded.

gizmoguy force-pushed the tool-upgrade-excludes branch from 5a58af6 to 1779efd Compare February 16, 2026 05:46

gizmoguy requested a review from zanieb February 17, 2026 21:19

charliermarsh added 2 commits March 3, 2026 11:38

Merge branch 'main' into tool-upgrade-excludes

c339b9f

Add from_excludes

af634c5

charliermarsh approved these changes Mar 3, 2026

View reviewed changes

charliermarsh added the bug Something isn't working label Mar 3, 2026

Tweaks

466e71a

charliermarsh enabled auto-merge (squash) March 3, 2026 16:57

charliermarsh merged commit 753ad06 into astral-sh:main Mar 3, 2026
52 checks passed

charliermarsh mentioned this pull request Mar 3, 2026

Respect exclusions in scripts #18269

Merged

charliermarsh added a commit that referenced this pull request Mar 3, 2026

Respect exclusions in scripts (#18269)

06933d2

## Summary See: #18022 (comment).

BrewTestBot mentioned this pull request Mar 3, 2026

uv 0.10.8 Homebrew/homebrew-core#270468

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prevent uv tool upgrade from installing excluded dependencies#18022

Prevent uv tool upgrade from installing excluded dependencies#18022
charliermarsh merged 4 commits intoastral-sh:mainfrom
gizmoguy:tool-upgrade-excludes

gizmoguy commented Feb 15, 2026

Uh oh!

zanieb Feb 15, 2026

Uh oh!

zanieb Feb 15, 2026

Uh oh!

gizmoguy Feb 16, 2026

Uh oh!

charliermarsh Mar 3, 2026

Uh oh!

zanieb commented Feb 15, 2026

Uh oh!

gizmoguy commented Feb 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// Add excludes from tool receipt to requirements
		spec.excludes = existing_tool_receipt.excludes().to_vec();

Conversation

gizmoguy commented Feb 15, 2026

Summary

Test Plan

Uh oh!

zanieb Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

zanieb Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

gizmoguy Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

charliermarsh Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

zanieb commented Feb 15, 2026

Uh oh!

gizmoguy commented Feb 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants