Reject invalid Git archive paths in lockfiles by konstin · Pull Request #21780 · astral-sh/uv

konstin · 2026-09-17T14:44:37Z

A lockfile with a Git source edited to contain ?path=foo makes uv export --frozen panic because the path has no supported archive extension and requirements formatting cannot return that error. Instead, validate and show a dedicated error.

woodruffw · 2026-09-17T14:58:09Z

Sign in to view

+    exit_code: 2 (failure)
+    ----- stderr -----
+    error: Failed to parse `uv.lock`
+      cause: Failed to parse file extension for `example==1.0.0 @ git+https://example.com/pkg.git?path=foo#0000000000000000000000000000000000000000`; expected one of: `.whl`, `.tar.gz`, `.zip`, `.tar.bz2`, `.tar.lz`, `.tar.lzma`, `.tar.xz`, `.tar.zst`, `.tar`, `.tbz`, `.tgz`, `.tlz`, or `.txz`


This error message is kind of confusing to me: the problem isn't the extension, but that there's a query string (?...) following it. Maybe we can make that more precise, i.e. have an error variant saying that we don't expect a query string on a Git URL?

I switched to a dedicated error message.

woodruffw · 2026-09-17T14:58:41Z

+        if let Source::Git(_, git) = &self.id.source
+            && let Some(path) = &git.path
+        {
+            DistExtension::from_path(path).map_err(|err| LockErrorKind::MissingExtension {


Q: this checks against the various sdist/wheel extensions, but .git itself isn't one of them. Is that intentional here?

Yeah that is for path=

It's apparently not reachable without a manual uv.lock edit.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.16` → `0.12.17` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](astral-sh/uv@0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/58 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.16` → `0.12.17` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](astral-sh/uv@0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/47 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.13` → `0.12.17` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](astral-sh/uv@0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](astral-sh/uv@0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#21742](astral-sh/uv#21742)) - Handle malformed index URLs without panicking when credentials are configured ([#21784](astral-sh/uv#21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#21781](astral-sh/uv#21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#21783](astral-sh/uv#21783)) ### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215) [Compare Source](astral-sh/uv@0.12.14...0.12.15) Released on 2026-09-15. This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using `uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#21699](astral-sh/uv#21699)) ##### Performance - Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#21675](astral-sh/uv#21675)) ##### Bug fixes - Revert "Reject symlinked wheel installation destinations" ([#21699](astral-sh/uv#21699)) ### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214) [Compare Source](astral-sh/uv@0.12.13...0.12.14) Released on 2026-09-15. Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#17110](astral-sh/uv#17110), [#21599](astral-sh/uv#21599), [#21603](astral-sh/uv#21603)) Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#17110](astral-sh/uv#17110)) ##### Enhancements - Resume interrupted downloads with HTTP Range requests when supported ([#21570](astral-sh/uv#21570)) - Show underlying causes and hints in user warnings ([#21565](astral-sh/uv#21565)) - Show resolver hints for failed `uv tool upgrade` operations ([#21566](astral-sh/uv#21566)) ##### Preview features - Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#21618](astral-sh/uv#21618)) ##### Performance - Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#21619](astral-sh/uv#21619)) - Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#21593](astral-sh/uv#21593)) - Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#21621](astral-sh/uv#21621)) ##### Bug fixes - Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#21672](astral-sh/uv#21672)) - Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#21625](astral-sh/uv#21625)) - Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#21639](astral-sh/uv#21639)) - Redact credentials and signatures from missing-path-segment URL errors ([#21616](astral-sh/uv#21616)) - Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#21640](astral-sh/uv#21640)) - Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#21559](astral-sh/uv#21559)) - Suppress managed-Python fallback warnings under `--quiet` ([#21565](astral-sh/uv#21565)) - Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#21566](astral-sh/uv#21566)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/632

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Reject invalid Git archive paths in lockfiles

35be0da

konstin deployed to automations September 17, 2026 14:45 — with GitHub Actions Active

woodruffw approved these changes Sep 17, 2026

View reviewed changes

Add separate variant

672164b

konstin added the area:error-messages Messaging when something goes wrong label Sep 18, 2026

konstin had a problem deploying to automations September 18, 2026 11:44 — with GitHub Actions Error

Test without fragment too

f3d21d3

konstin deployed to automations September 18, 2026 11:50 — with GitHub Actions Active

konstin merged commit f61923a into main Sep 18, 2026
116 checks passed

konstin deleted the konsti/lock-invalid-git-path branch September 18, 2026 11:59

BrewTestBot mentioned this pull request Sep 18, 2026

uv 0.12.17 Homebrew/homebrew-core#312078

Merged

saidsef mentioned this pull request Sep 20, 2026

chore(deps): review astral-sh/uv 0.12.13 → 0.12.17 (#447) saidsef/mcp-github-pr-issue-analyser#450

Closed

5 tasks done

astral-sh deleted a comment from zarshed-business-dev Sep 23, 2026

scottames-github-bot Bot mentioned this pull request Sep 23, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1074

Merged

1 task

Navigation Menu

Repository navigation

Reject invalid Git archive paths in lockfiles - #21780

Reject invalid Git archive paths in lockfiles#21780
konstin merged 3 commits into
mainfrom
konsti/lock-invalid-git-path

konstin commented Sep 17, 2026 •

edited

Loading

Uh oh!

woodruffw Sep 17, 2026

Uh oh!

konstin Sep 18, 2026

Uh oh!

This comment was marked as spam.

Uh oh!

woodruffw Sep 17, 2026

Uh oh!

konstin Sep 18, 2026

Uh oh!

konstin Sep 18, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

konstin commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

woodruffw Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

konstin Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as spam.

Uh oh!

woodruffw Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

konstin Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

konstin Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

konstin commented Sep 17, 2026 •

edited

Loading