Conversation
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
commented
Nov 6, 2025
woodruffw
commented
Nov 6, 2025
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
zanieb
reviewed
Nov 10, 2025
konstin
reviewed
Nov 10, 2025
zanieb
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
Member
Author
|
635d1f4 pushes the logic up to the |
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
temporarily deployed
to
uv-test-publish
GitHub Actions
Inactive
woodruffw
force-pushed
the
ww/url-ambiguity
branch
from
a112256 to
635d1f4
Compare
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
temporarily deployed
to
uv-test-publish
GitHub Actions
Inactive
woodruffw
force-pushed
the
ww/url-ambiguity
branch
from
635d1f4 to
a87cc60
Compare
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
temporarily deployed
to
uv-test-publish
GitHub Actions
Inactive
woodruffw
commented
Nov 11, 2025
woodruffw
force-pushed
the
ww/url-ambiguity
branch
from
a87cc60 to
c17bb26
Compare
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
temporarily deployed
to
uv-test-publish
GitHub Actions
Inactive
konstin
added a commit
that referenced
this pull request
Nov 11, 2025
konstin
added a commit
that referenced
this pull request
Nov 11, 2025
woodruffw
force-pushed
the
ww/url-ambiguity
branch
from
c17bb26 to
f07a6a7
Compare
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
had a problem deploying
to
uv-test-publish
GitHub Actions
Failure
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
woodruffw
had a problem deploying
to
uv-test-publish
GitHub Actions
Error
konstin
added
the
enhancement
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
woodruffw
force-pushed
the
ww/url-ambiguity
branch
from
6bd4631 to
be08342
Compare
woodruffw
had a problem deploying
to
uv-test-registries
GitHub Actions
Failure
woodruffw
temporarily deployed
to
uv-test-publish
GitHub Actions
Inactive
woodruffw
temporarily deployed
to
uv-test-registries
GitHub Actions
Inactive
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Nov 14, 2025
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.9.8` -> `0.9.9` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.9.9`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#099) [Compare Source](astral-sh/uv@0.9.8...0.9.9) Released on 2025-11-12. ##### Deprecations - Deprecate use of `--project` in `uv init` ([#​16674](astral-sh/uv#16674)) ##### Enhancements - Add iOS support to Python interpreter discovery ([#​16686](astral-sh/uv#16686)) - Reject ambiguously parsed URLs ([#​16622](astral-sh/uv#16622)) - Allow explicit values in `uv version --bump` ([#​16555](astral-sh/uv#16555)) - Warn on use of managed pre-release Python versions when a stable version is available ([#​16619](astral-sh/uv#16619)) - Allow signing trampolines on Windows by using `.rcdata` to store metadata ([#​15068](astral-sh/uv#15068)) - Add `--only-emit-workspace` and similar variants to `uv export` ([#​16681](astral-sh/uv#16681)) ##### Preview features - Add `uv workspace dir` command ([#​16678](astral-sh/uv#16678)) - Add `uv workspace metadata` command ([#​16516](astral-sh/uv#16516)) ##### Configuration - Add `UV_NO_DEFAULT_GROUPS` environment variable ([#​16645](astral-sh/uv#16645)) ##### Bug fixes - Remove `torch-model-archiver` and `torch-tb-profiler` from PyTorch backend ([#​16655](astral-sh/uv#16655)) - Fix Pixi environment detection ([#​16585](astral-sh/uv#16585)) ##### Documentation - Fix `CMD` path in FastAPI Dockerfile ([#​16701](astral-sh/uv#16701)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
|
I believe this change has broken local editable installs that contain @ in their directory |
konstin
added a commit
that referenced
this pull request
Nov 17, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This tweaks
DisplaySafeUrlto reject some ambiguous parsing cases that WHATWG and RFC 3986 otherwise consider valid. Specifically, we reject URLs where the path or fragment component looks like it contains auser:pass, indicating that the parser didn't disambiguate a userinfo section.The most common underlying reason for this is user error: if a user manually configures something like an index URL with a username or password containing a non-escaped
/or#, both RFC 3986 and WHATWG treat that as the beginning of the path/fragment rather than a part of the username/password itself.Test Plan
I've added unit and integration tests for this. There's a nonzero chance that this snares real-world URLs out there, but I think that risk is pretty small.