Skip to content

Validate egg top-level entries as identifiers#19679

Merged
charliermarsh merged 2 commits into
mainfrom
charlie/validate-egg-top-level-identifiers
Jun 4, 2026
Merged

Validate egg top-level entries as identifiers#19679
charliermarsh merged 2 commits into
mainfrom
charlie/validate-egg-top-level-identifiers

Conversation

@charliermarsh

Copy link
Copy Markdown
Member

Summary

Prior to this change, we accepted any non-empty egg top_level.txt entry without path separators. On Windows, drive-relative paths such as C:target contain no separators, so they passed validation even though they do not represent a top-level module or package name.

This PR validates each entry as a Python identifier before using it to remove an installed module or package. This matches the top_level.txt format and skips drive-relative and other malformed entries. It also adds focused unit coverage and a Windows integration test that confirms an invalid drive-relative entry is ignored while the egg is otherwise uninstalled normally.

@charliermarsh charliermarsh requested a review from zsol June 4, 2026 17:14
@charliermarsh charliermarsh marked this pull request as ready for review June 4, 2026 17:15
@charliermarsh charliermarsh added the bug Something isn't working label Jun 4, 2026
Comment thread crates/uv-install-wheel/src/uninstall.rs Outdated
@charliermarsh charliermarsh enabled auto-merge (squash) June 4, 2026 17:35
@charliermarsh charliermarsh merged commit ff9bf54 into main Jun 4, 2026
55 checks passed
@charliermarsh charliermarsh deleted the charlie/validate-egg-top-level-identifiers branch June 4, 2026 17:44
konstin added a commit that referenced this pull request Jun 10, 2026
Released on 2026-06-10.

### Enhancements

- Add `--emit-index-url` and `--emit-find-links` to `uv export`
([#18370](#18370))
- Add `--find-links` support for `uv pip list`
([#16103](#16103))
- Group executable install errors during `uv python install`
([#19691](#19691))
- Use ICF in macOS release builds to reduce binary sizes
([#19615](#19615))

### Preview features

- Add initial hidden `uv upgrade` command
([#19678](#19678))
- Reject Git revisions in `uv upgrade`
([#19742](#19742))

### Configuration

- Recognize `UV_NO_INSTALL_PROJECT`, `UV_NO_INSTALL_WORKSPACE`,
`UV_NO_INSTALL_LOCAL`
([#19323](#19323))

### Performance

- Speed up discovery of large workspaces
([#18311](#18311))

### Bug fixes

- Allow unknown preview flags with a warning again
([#19669](#19669))
- Apply dependency exclusions to direct requirements
([#19699](#19699))
- Avoid following external symlinks during cache clean
([#19682](#19682))
- Avoid following symlinks during cache prune
([#19543](#19543))
- Fix Git cache keys for worktrees and packed refs
([#19706](#19706))
- Make resolver error handling iterative to avoid stack overflows
([#19695](#19695))
- Pass `VIRTUAL_ENV` through `cygpath` inside `fish` on Windows
([#19703](#19703))
- Rebuild explicit local directory tool installs
([#19591](#19591))
- Validate egg top-level entries as identifiers
([#19679](#19679))

### Documentation

- Document `--find-links` caching behavior
([#19585](#19585))
- Add a small section for malware checks
([#19680](#19680))
blake-hamm added a commit to blake-hamm/bhamm-lab that referenced this pull request Jun 10, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.11.19` → `0.11.20` |

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.11.20`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01120)

Released on 2026-06-10.

##### Enhancements

- Add `--emit-index-url` and `--emit-find-links` to `uv export` ([#&#8203;18370](astral-sh/uv#18370))
- Add `--find-links` support for `uv pip list` ([#&#8203;16103](astral-sh/uv#16103))
- Group executable install errors during `uv python install` ([#&#8203;19691](astral-sh/uv#19691))
- Use ICF in macOS release builds to reduce binary sizes ([#&#8203;19615](astral-sh/uv#19615))

##### Preview features

- Add initial hidden `uv upgrade` command ([#&#8203;19678](astral-sh/uv#19678))
- Reject Git revisions in `uv upgrade` ([#&#8203;19742](astral-sh/uv#19742))

##### Configuration

- Recognize `UV_NO_INSTALL_PROJECT`, `UV_NO_INSTALL_WORKSPACE`, `UV_NO_INSTALL_LOCAL` ([#&#8203;19323](astral-sh/uv#19323))

##### Performance

- Speed up discovery of large workspaces ([#&#8203;18311](astral-sh/uv#18311))

##### Bug fixes

- Allow unknown preview flags with a warning again ([#&#8203;19669](astral-sh/uv#19669))
- Apply dependency exclusions to direct requirements ([#&#8203;19699](astral-sh/uv#19699))
- Avoid following external symlinks during cache clean ([#&#8203;19682](astral-sh/uv#19682))
- Avoid following symlinks during cache prune ([#&#8203;19543](astral-sh/uv#19543))
- Fix Git cache keys for worktrees and packed refs ([#&#8203;19706](astral-sh/uv#19706))
- Make resolver error handling iterative to avoid stack overflows ([#&#8203;19695](astral-sh/uv#19695))
- Pass `VIRTUAL_ENV` through `cygpath` inside `fish` on Windows ([#&#8203;19703](astral-sh/uv#19703))
- Rebuild explicit local directory tool installs ([#&#8203;19591](astral-sh/uv#19591))
- Validate egg top-level entries as identifiers ([#&#8203;19679](astral-sh/uv#19679))

##### Documentation

- Document `--find-links` caching behavior ([#&#8203;19585](astral-sh/uv#19585))
- Add a small section for malware checks ([#&#8203;19680](astral-sh/uv#19680))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIyMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: Renovate Bot <renovate@bhamm-lab.com>
Reviewed-on: https://codeberg.org/blake-hamm/bhamm-lab/pulls/186
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants