Skip to content

Avoid following external symlinks during cache clean#19682

Merged
charliermarsh merged 2 commits into
mainfrom
charlie/cache-clean-symlink-target
Jun 5, 2026
Merged

Avoid following external symlinks during cache clean#19682
charliermarsh merged 2 commits into
mainfrom
charlie/cache-clean-symlink-target

Conversation

@charliermarsh

Copy link
Copy Markdown
Member

Summary

Prior to this change, uv cache clean <package> treated every resolved cache reference as an archive entry. On Unix, an unexpected symlink in a wheel or source-distribution cache bucket could therefore cause package-specific cleanup to remove a directory outside the cache after deleting the symlink.

This PR restricts post-cleanup archive garbage collection to canonical targets beneath archive-v0. It preserves normal archive cleanup and adds integration coverage that confirms an in-cache archive is removed while an external symlink target is preserved.

Follow-up to #19543.

@charliermarsh charliermarsh marked this pull request as ready for review June 5, 2026 01:51
@charliermarsh charliermarsh added the bug Something isn't working label Jun 5, 2026
@charliermarsh charliermarsh enabled auto-merge (squash) June 5, 2026 01:56
@charliermarsh charliermarsh merged commit 436bf40 into main Jun 5, 2026
109 of 110 checks passed
@charliermarsh charliermarsh deleted the charlie/cache-clean-symlink-target branch June 5, 2026 02:05
konstin added a commit that referenced this pull request Jun 10, 2026
Released on 2026-06-10.

### Enhancements

- Add `--emit-index-url` and `--emit-find-links` to `uv export`
([#18370](#18370))
- Add `--find-links` support for `uv pip list`
([#16103](#16103))
- Group executable install errors during `uv python install`
([#19691](#19691))
- Use ICF in macOS release builds to reduce binary sizes
([#19615](#19615))

### Preview features

- Add initial hidden `uv upgrade` command
([#19678](#19678))
- Reject Git revisions in `uv upgrade`
([#19742](#19742))

### Configuration

- Recognize `UV_NO_INSTALL_PROJECT`, `UV_NO_INSTALL_WORKSPACE`,
`UV_NO_INSTALL_LOCAL`
([#19323](#19323))

### Performance

- Speed up discovery of large workspaces
([#18311](#18311))

### Bug fixes

- Allow unknown preview flags with a warning again
([#19669](#19669))
- Apply dependency exclusions to direct requirements
([#19699](#19699))
- Avoid following external symlinks during cache clean
([#19682](#19682))
- Avoid following symlinks during cache prune
([#19543](#19543))
- Fix Git cache keys for worktrees and packed refs
([#19706](#19706))
- Make resolver error handling iterative to avoid stack overflows
([#19695](#19695))
- Pass `VIRTUAL_ENV` through `cygpath` inside `fish` on Windows
([#19703](#19703))
- Rebuild explicit local directory tool installs
([#19591](#19591))
- Validate egg top-level entries as identifiers
([#19679](#19679))

### Documentation

- Document `--find-links` caching behavior
([#19585](#19585))
- Add a small section for malware checks
([#19680](#19680))
blake-hamm added a commit to blake-hamm/bhamm-lab that referenced this pull request Jun 10, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.11.19` → `0.11.20` |

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.11.20`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01120)

Released on 2026-06-10.

##### Enhancements

- Add `--emit-index-url` and `--emit-find-links` to `uv export` ([#&#8203;18370](astral-sh/uv#18370))
- Add `--find-links` support for `uv pip list` ([#&#8203;16103](astral-sh/uv#16103))
- Group executable install errors during `uv python install` ([#&#8203;19691](astral-sh/uv#19691))
- Use ICF in macOS release builds to reduce binary sizes ([#&#8203;19615](astral-sh/uv#19615))

##### Preview features

- Add initial hidden `uv upgrade` command ([#&#8203;19678](astral-sh/uv#19678))
- Reject Git revisions in `uv upgrade` ([#&#8203;19742](astral-sh/uv#19742))

##### Configuration

- Recognize `UV_NO_INSTALL_PROJECT`, `UV_NO_INSTALL_WORKSPACE`, `UV_NO_INSTALL_LOCAL` ([#&#8203;19323](astral-sh/uv#19323))

##### Performance

- Speed up discovery of large workspaces ([#&#8203;18311](astral-sh/uv#18311))

##### Bug fixes

- Allow unknown preview flags with a warning again ([#&#8203;19669](astral-sh/uv#19669))
- Apply dependency exclusions to direct requirements ([#&#8203;19699](astral-sh/uv#19699))
- Avoid following external symlinks during cache clean ([#&#8203;19682](astral-sh/uv#19682))
- Avoid following symlinks during cache prune ([#&#8203;19543](astral-sh/uv#19543))
- Fix Git cache keys for worktrees and packed refs ([#&#8203;19706](astral-sh/uv#19706))
- Make resolver error handling iterative to avoid stack overflows ([#&#8203;19695](astral-sh/uv#19695))
- Pass `VIRTUAL_ENV` through `cygpath` inside `fish` on Windows ([#&#8203;19703](astral-sh/uv#19703))
- Rebuild explicit local directory tool installs ([#&#8203;19591](astral-sh/uv#19591))
- Validate egg top-level entries as identifiers ([#&#8203;19679](astral-sh/uv#19679))

##### Documentation

- Document `--find-links` caching behavior ([#&#8203;19585](astral-sh/uv#19585))
- Add a small section for malware checks ([#&#8203;19680](astral-sh/uv#19680))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIyMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: Renovate Bot <renovate@bhamm-lab.com>
Reviewed-on: https://codeberg.org/blake-hamm/bhamm-lab/pulls/186
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant