Skip to content

Comments

Respect URL-encoded credentials in redirect location#14315

Merged
jtfmumm merged 1 commit intomainfrom
jtfm/redirect-url-credentials
Jun 27, 2025
Merged

Respect URL-encoded credentials in redirect location#14315
jtfmumm merged 1 commit intomainfrom
jtfm/redirect-url-credentials

Conversation

@jtfmumm
Copy link
Contributor

@jtfmumm jtfmumm commented Jun 27, 2025

uv currently ignores URL-encoded credentials in a redirect location. This PR adds a check for these credentials to the redirect handling logic. If found, they are moved to the Authorization header in the redirect request.

Closes #11097

@jtfmumm jtfmumm added bug Something isn't working network Network connectivity e.g. proxies, DNS, and SSL labels Jun 27, 2025
@jtfmumm jtfmumm changed the title Handle URL-encoded credentials in redirect location Respect URL-encoded credentials in redirect location Jun 27, 2025
@jtfmumm jtfmumm temporarily deployed to uv-test-registries June 27, 2025 13:59 — with GitHub Actions Inactive
Copy link
Member

@charliermarsh charliermarsh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems reasonable to me, though with auth it's always hard to predict whether some obscure setup will break 😭

@jtfmumm
Copy link
Contributor Author

jtfmumm commented Jun 27, 2025

This seems reasonable to me, though with auth it's always hard to predict whether some obscure setup will break 😭

I think this is a pretty rare case in general, but we'll see!

@jtfmumm jtfmumm merged commit a824468 into main Jun 27, 2025
87 checks passed
@jtfmumm jtfmumm deleted the jtfm/redirect-url-credentials branch June 27, 2025 14:41
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jun 29, 2025
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.7.14` -> `0.7.16` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>astral-sh/uv (astral-sh/uv)</summary>

### [`v0.7.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0716)

[Compare Source](astral-sh/uv@0.7.15...0.7.16)

##### Python

- Add Python 3.14.0b3

See the
[`python-build-standalone` release notes](https://github.com/astral-sh/python-build-standalone/releases/tag/20250626)
for more details.

##### Enhancements

- Include path or URL when failing to convert in lockfile ([#&#8203;14292](astral-sh/uv#14292))
- Warn when `~=` is used as a Python version specifier without a patch version ([#&#8203;14008](astral-sh/uv#14008))

##### Preview features

- Ensure preview default Python installs are upgradeable ([#&#8203;14261](astral-sh/uv#14261))

##### Performance

- Share workspace cache between lock and sync operations ([#&#8203;14321](astral-sh/uv#14321))

##### Bug fixes

- Allow local indexes to reference remote files ([#&#8203;14294](astral-sh/uv#14294))
- Avoid rendering desugared prefix matches in error messages ([#&#8203;14195](astral-sh/uv#14195))
- Avoid using path URL for workspace Git dependencies in `requirements.txt` ([#&#8203;14288](astral-sh/uv#14288))
- Normalize index URLs to remove trailing slash ([#&#8203;14245](astral-sh/uv#14245))
- Respect URL-encoded credentials in redirect location ([#&#8203;14315](astral-sh/uv#14315))
- Lock the source tree when running setuptools, to protect concurrent builds ([#&#8203;14174](astral-sh/uv#14174))

##### Documentation

- Note that GCP Artifact Registry download URLs must have `/simple` component ([#&#8203;14251](astral-sh/uv#14251))

### [`v0.7.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0715)

[Compare Source](astral-sh/uv@0.7.14...0.7.15)

##### Enhancements

- Consistently use `Ordering::Relaxed` for standalone atomic use cases ([#&#8203;14190](astral-sh/uv#14190))
- Warn on ambiguous relative paths for `--index` ([#&#8203;14152](astral-sh/uv#14152))
- Skip GitHub fast path when rate-limited ([#&#8203;13033](astral-sh/uv#13033))
- Preserve newlines in `schema.json` descriptions ([#&#8203;13693](astral-sh/uv#13693))

##### Bug fixes

- Add check for using minor version link when creating a venv on Windows ([#&#8203;14252](astral-sh/uv#14252))
- Strip query parameters when parsing source URL ([#&#8203;14224](astral-sh/uv#14224))

##### Documentation

- Add a link to PyPI FAQ to clarify what per-project token is ([#&#8203;14242](astral-sh/uv#14242))

##### Preview features

- Allow symlinks in the build backend ([#&#8203;14212](astral-sh/uv#14212))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90Il19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working network Network connectivity e.g. proxies, DNS, and SSL

Projects

None yet

Development

Successfully merging this pull request may close these issues.

uv fails on HTTP redirects with authentication

2 participants