Allow reading requirements from scripts with HTTP(S) paths by charliermarsh · Pull Request #16891 · astral-sh/uv

charliermarsh · 2025-11-29T01:44:38Z

Summary

Closes #16890.

codspeed-hq · 2025-11-29T02:15:06Z

CodSpeed Performance Report

Merging #16891 will not alter performance

_{Comparing charlie/script-http (ad4fd26) with main (d2162e2)}

Summary

✅ 6 untouched

konstin · 2025-12-01T09:46:46Z

crates/uv-requirements/src/specification.rs

+async fn read_file(path: &Path, client_builder: &BaseClientBuilder<'_>) -> Result<String> {
+    // If the path is a URL, fetch it over HTTP(S).
+    if path.starts_with("http://") || path.starts_with("https://") {
+        // Only continue if we are absolutely certain no local file exists.


This feels inconsistent with how we treat http:// prefixes in other places, where we use the prefix to have the user control whether a resource is remote or local and which protocol to use (e.g. git+ or the inverse case for indexes, where ./ is used to mark a local directory). In other cases, we'll check online directly, even if a local file exists, e.g. uv pip compile http://example.com where cat http://example.com exists

I think this matches an existing implementation? It was chosen for safety purposes.

uv/crates/uv/src/commands/project/run.rs

Lines 1733 to 1740 in 2d9fe7c

// Determine whether the user provided a remote script.

if target_path.starts_with("http://") || target_path.starts_with("https://") {

// Only continue if we are absolutely certain no local file exists.

//

// We don't do this check on Windows since the file path would

// be invalid anyway, and thus couldn't refer to a local file.

if !cfg!(unix) || matches!(target_path.try_exists(), Ok(false)) {

let mut url = DisplaySafeUrl::parse(&target.to_string_lossy())?;

See #6375 (review)

cc @BurntSushi

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.9.13` -> `0.9.17` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.9.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0917) [Compare Source](astral-sh/uv@0.9.16...0.9.17) Released on 2025-12-09. ##### Enhancements - Add `torch-tensorrt` and `torchao` to the PyTorch list ([#17053](astral-sh/uv#17053)) - Add hint for misplaced `--verbose` in `uv tool run` ([#17020](astral-sh/uv#17020)) - Add support for relative durations in `exclude-newer` (a.k.a., dependency cooldowns) ([#16814](astral-sh/uv#16814)) - Add support for relocatable nushell activation script ([#17036](astral-sh/uv#17036)) ##### Bug fixes - Respect dropped (but explicit) indexes in dependency groups ([#17012](astral-sh/uv#17012)) ##### Documentation - Improve `source-exclude` reference docs ([#16832](astral-sh/uv#16832)) - Recommend `UV_NO_DEV` in Docker installs ([#17030](astral-sh/uv#17030)) - Update `UV_VERSION` in docs for GitLab CI/CD ([#17040](astral-sh/uv#17040)) ### [`v0.9.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0916) [Compare Source](astral-sh/uv@0.9.15...0.9.16) Released on 2025-12-06. ##### Python - Add CPython 3.14.2 - Add CPython 3.13.11 ##### Enhancements - Add a 5m default timeout to acquiring file locks to fail faster on deadlock ([#16342](astral-sh/uv#16342)) - Add a stub `debug` subcommand to `uv pip` announcing its intentional absence ([#16966](astral-sh/uv#16966)) - Add bounds in `uv add --script` ([#16954](astral-sh/uv#16954)) - Add brew specific message for `uv self update` ([#16838](astral-sh/uv#16838)) - Error when built wheel is for the wrong platform ([#16074](astral-sh/uv#16074)) - Filter wheels from PEP 751 files based on `--no-binary` et al in `uv pip compile` ([#16956](astral-sh/uv#16956)) - Support `--target` and `--prefix` in `uv pip list`, `uv pip freeze`, and `uv pip show` ([#16955](astral-sh/uv#16955)) - Tweak language for build backend validation errors ([#16720](astral-sh/uv#16720)) - Use explicit credentials cache instead of global static ([#16768](astral-sh/uv#16768)) - Enable SIMD in HTML parsing ([#17010](astral-sh/uv#17010)) ##### Preview features - Fix missing preview warning in `uv workspace metadata` ([#16988](astral-sh/uv#16988)) - Add a `uv auth helper --protocol bazel` command ([#16886](astral-sh/uv#16886)) ##### Bug fixes - Fix Pyston wheel compatibility tags ([#16972](astral-sh/uv#16972)) - Allow redundant entries in `tool.uv.build-backend.module-name` but emit warnings ([#16928](astral-sh/uv#16928)) - Fix infinite loop in non-attribute re-treats during HTML parsing ([#17010](astral-sh/uv#17010)) ##### Documentation - Clarify `--project` flag help text to indicate project discovery ([#16965](astral-sh/uv#16965)) - Regenerate the crates.io READMEs on release ([#16992](astral-sh/uv#16992)) - Update Docker integration guide to prefer `COPY` over `ADD` for simple cases ([#16883](astral-sh/uv#16883)) - Update PyTorch documentation to include information about supporting CUDA 13.0.x ([#16957](astral-sh/uv#16957)) - Update the versioning policy ([#16710](astral-sh/uv#16710)) - Upgrade PyTorch documentation to latest versions ([#16970](astral-sh/uv#16970)) ### [`v0.9.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0915) [Compare Source](astral-sh/uv@0.9.14...0.9.15) Released on 2025-12-02. ##### Python - Add CPython 3.14.1 - Add CPython 3.13.10 ##### Enhancements - Add ROCm 6.4 to `--torch-backend=auto` ([#16919](astral-sh/uv#16919)) - Add a Windows manifest to uv binaries ([#16894](astral-sh/uv#16894)) - Add LFS toggle to Git sources ([#16143](astral-sh/uv#16143)) - Cache source reads during resolution ([#16888](astral-sh/uv#16888)) - Allow reading requirements from scripts without an extension ([#16923](astral-sh/uv#16923)) - Allow reading requirements from scripts with HTTP(S) paths ([#16891](astral-sh/uv#16891)) ##### Configuration - Add `UV_HIDE_BUILD_OUTPUT` to omit build logs ([#16885](astral-sh/uv#16885)) ##### Bug fixes - Fix `uv-trampoline-builder` builds from crates.io by moving bundled executables ([#16922](astral-sh/uv#16922)) - Respect `NO_COLOR` and always show the command as a header when paging `uv help` output ([#16908](astral-sh/uv#16908)) - Use `0o666` permissions for flock files instead of `0o777` ([#16845](astral-sh/uv#16845)) - Revert "Bump `astral-tl` to v0.7.10 ([#16887](astral-sh/uv#16887))" to narrow down a regression causing hangs in metadata retrieval ([#16938](astral-sh/uv#16938)) ##### Documentation - Link to the uv version in crates.io member READMEs ([#16939](astral-sh/uv#16939)) ### [`v0.9.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0914) [Compare Source](astral-sh/uv@0.9.13...0.9.14) Released on 2025-12-01. ##### Performance - Bump `astral-tl` to v0.7.10 to enable SIMD for HTML parsing ([#16887](astral-sh/uv#16887)) ##### Bug fixes - Allow earlier post releases with exclusive ordering ([#16881](astral-sh/uv#16881)) - Prefer updating existing `.zshenv` over creating a new one in `tool update-shell` ([#16866](astral-sh/uv#16866)) - Respect `-e` flags in `uv add` ([#16882](astral-sh/uv#16882)) ##### Enhancements - Attach subcommand to User-Agent string ([#16837](astral-sh/uv#16837)) - Prefer `UV_WORKING_DIR` over `UV_WORKING_DIRECTORY` for consistency ([#16884](astral-sh/uv#16884)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

charliermarsh requested review from konstin and zanieb November 29, 2025 01:44

charliermarsh added the enhancement New feature or improvement to existing functionality label Nov 29, 2025

charliermarsh marked this pull request as ready for review November 29, 2025 01:44

charliermarsh temporarily deployed to uv-test-registries November 29, 2025 01:47 — with GitHub Actions Inactive

konstin approved these changes Dec 1, 2025

View reviewed changes

Base automatically changed from charlie/extentionless to charlie/source-cache December 2, 2025 09:22

zanieb force-pushed the charlie/source-cache branch from f0f5b66 to d5dad4e Compare December 2, 2025 09:24

Base automatically changed from charlie/source-cache to main December 2, 2025 09:38

Allow HTTP

464ff85

zanieb force-pushed the charlie/script-http branch from 7cb873d to 464ff85 Compare December 2, 2025 11:06

zanieb changed the title ~~Accept scripts from HTTP(S) paths~~ Accept scripts from HTTP(S) paths in -r Dec 2, 2025

zanieb changed the title ~~Accept scripts from HTTP(S) paths in -r~~ Allow reading requirements from scripts with HTTP(S) paths Dec 2, 2025

zanieb enabled auto-merge (squash) December 2, 2025 11:08

zanieb temporarily deployed to uv-test-registries December 2, 2025 11:08 — with GitHub Actions Inactive

zanieb added 2 commits December 2, 2025 17:12

Update snapshot

a527b5c

Merge branch 'main' into charlie/script-http

0e14250

zanieb temporarily deployed to uv-test-registries December 2, 2025 23:14 — with GitHub Actions Inactive

Windows

ad4fd26

zanieb temporarily deployed to uv-test-registries December 2, 2025 23:30 — with GitHub Actions Inactive

zanieb merged commit 87adf14 into main Dec 2, 2025
101 checks passed

zanieb deleted the charlie/script-http branch December 2, 2025 23:42

BrewTestBot mentioned this pull request Dec 3, 2025

uv 0.9.15 Homebrew/homebrew-core#256853

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Allow reading requirements from scripts with HTTP(S) paths#16891

Allow reading requirements from scripts with HTTP(S) paths#16891
zanieb merged 4 commits intomainfrom
charlie/script-http

charliermarsh commented Nov 29, 2025

Uh oh!

codspeed-hq bot commented Nov 29, 2025 •

edited

Loading

Uh oh!

konstin Dec 1, 2025

Uh oh!

zanieb Dec 2, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	// Determine whether the user provided a remote script.
	if target_path.starts_with("http://") \|\| target_path.starts_with("https://") {
	// Only continue if we are absolutely certain no local file exists.
	//
	// We don't do this check on Windows since the file path would
	// be invalid anyway, and thus couldn't refer to a local file.
	if !cfg!(unix) \|\| matches!(target_path.try_exists(), Ok(false)) {
	let mut url = DisplaySafeUrl::parse(&target.to_string_lossy())?;

Comments

Conversation

charliermarsh commented Nov 29, 2025

Summary

Uh oh!

codspeed-hq bot commented Nov 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodSpeed Performance Report

Merging #16891 will not alter performance

Summary

Uh oh!

konstin Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

zanieb Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codspeed-hq bot commented Nov 29, 2025 •

edited

Loading