Bail when trying to attach ambiguous credentials instead of picking an arbitrary one by zsol · Pull Request #16983 · astral-sh/uv

zsol · 2025-12-04T18:00:18Z

Summary

This PR makes TextCredentialStore.get_credentials fail on ambiguous matches, instead of returning the first "best" match while iterating over all credentials.

Test Plan

Added a unit test, plus tested via:

❯ jq -n '{uri: "https://foo"}' | cargo -q run auth helper --protocol=bazel get
error: Multiple credentials found for URL 'https://foo/', specify which username to use

(the above needed two username/password combos registered for https://foo using uv auth login https://foo)

zsol · 2025-12-04T19:08:23Z

I applied the breaking label because technically this might change might cause currently (accidentally) working setups to suddenly stop attaching credentials in cases when the credentials were ambiguous.

konstin · 2025-12-05T18:39:09Z

Given that this is a preview feature, I'd consider it a preview change instead of a breaking change.

zanieb · 2025-12-05T20:10:19Z

Is the interface in preview? 🤔

konstin · 2025-12-08T11:13:17Z

I was thinking about this:

warning: The uv auth helper command is experimental and may change without warning. Pass --preview-features auth-helper to disable this warning

If that affects stable code too then it's breaking change.

zanieb · 2025-12-08T12:17:17Z

Yeah uv auth token should be affected by this change and is stable

zsol · 2025-12-08T12:21:43Z

Yes it does, here's a repro:

pushd $(mktemp -d)
# set up a basic auth pypi-server
htpasswd -bc passwords foo1 bar
uvx --python 3.12 --from pypiserver[passlib] pypi-server run -a 'download, list, update' -P passwords --log-stream stderr -v . &
# fetch a random wheel
curl -LO https://files.pythonhosted.org/packages/e9/44/75a9c9421471a6c4805dbf2356f7c181a29c1879239abab1ea2cc8f38b40/sniffio-1.3.1-py3-none-any.whl
# configure uv with two usernames on the same url
uv auth login http://localhost:8080 -u foo1 --password=bar
uv auth login http://localhost:8080 -u foo2 --password=bar

uv venv --clear
# latest version of uv succeeds
uvx uv pip install --default-index http://localhost:8080 sniffio --no-cache
# with -vv you can see it's using `foo1` (on my machine)

# with this PR:
~/dev/uv/target/debug/uv pip install --default-index http://localhost:8080 anyio --no-cache

  × No solution found when resolving dependencies:
  ╰─▶ Because anyio was not found in the package registry and you require anyio, we can conclude that your requirements are unsatisfiable.

      hint: An index URL (http://localhost:8080/) could not be queried due to a lack of valid authentication credentials (401 Unauthorized).

crates/uv-auth/src/middleware.rs

zsol

rebased on main

crates/uv-auth/src/middleware.rs

…n arbitrary one (#16983) This PR makes `TextCredentialStore.get_credentials` fail on ambiguous matches, instead of returning the first "best" match while iterating over all credentials. Added a unit test, plus tested via: ``` ❯ jq -n '{uri: "https://foo"}' | cargo -q run auth helper --protocol=bazel get error: Multiple credentials found for URL 'https://foo/', specify which username to use ``` (the above needed two username/password combos registered for `https://foo` using `uv auth login https://foo`)

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | minor | `0.9.28` → `0.10.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.10.0`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0100) [Compare Source](astral-sh/uv@0.9.30...0.10.0) Since we released uv [0.9.0](https://github.com/astral-sh/uv/releases/tag/0.9.0) in October of 2025, we've accumulated various changes that improve correctness and user experience, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. We expect most users to be able to upgrade without making changes. This release also includes the stabilization of preview features. Python upgrades are now stable, including the `uv python upgrade` command, `uv python install --upgrade`, and automatically upgrading Python patch versions in virtual environments when a new version is installed. The `add-bounds` and `extra-build-dependencies` settings are now stable. Finally, the `uv workspace dir` and `uv workspace list` utilities for writing scripts against workspace members are now stable. ##### Breaking changes - **Require `--clear` to remove existing virtual environments in `uv venv`** ([#17757](astral-sh/uv#17757)) Previously, `uv venv` would prompt for confirmation before removing an existing virtual environment in interactive contexts, and remove it without confirmation in non-interactive contexts. Now, `uv venv` requires the `--clear` flag to remove an existing virtual environment. A warning for this change was added in [uv 0.8](https://github.com/astral-sh/uv/blob/main/changelogs/0.8.x.md#breaking-changes). You can opt out of this behavior by passing the `--clear` flag or setting `UV_VENV_CLEAR=1`. - **Error if multiple indexes include `default = true`** ([#17011](astral-sh/uv#17011)) Previously, uv would silently accept multiple indexes with `default = true` and use the first one. Now, uv will error if multiple indexes are marked as the default. You cannot opt out of this behavior. Remove `default = true` from all but one index. - **Error when an `explicit` index is unnamed** ([#17777](astral-sh/uv#17777)) Explicit indexes can only be used via the `[tool.uv.sources]` table, which requires referencing the index by name. Previously, uv would silently accept unnamed explicit indexes, which could never be referenced. Now, uv will error if an explicit index does not have a name. You cannot opt out of this behavior. Add a `name` to the explicit index or remove the entry. - **Install alternative Python executables using their implementation name** ([#17756](astral-sh/uv#17756), [#17760](astral-sh/uv#17760)) Previously, `uv python install` would install PyPy, GraalPy, and Pyodide executables with names like `python3.10` into the bin directory. Now, these executables will be named using their implementation name, e.g., `pypy3.10`, `graalpy3.10`, and `pyodide3.12`, to avoid conflicting with CPython installations. You cannot opt out of this behavior. - **Respect global Python version pins in `uv tool run` and `uv tool install`** ([#14112](astral-sh/uv#14112)) Previously, `uv tool run` and `uv tool install` did not respect the global Python version pin (set via `uv python pin --global`). Now, these commands will use the global Python version when no explicit version is requested. For `uv tool install`, if the tool is already installed, the Python version will not change unless `--reinstall` or `--python` is provided. If the tool was previously installed with an explicit `--python` flag, the global pin will not override it. You can opt out of this behavior by providing an explicit `--python` flag. - **Remove Debian Bookworm, Alpine 3.21, and Python 3.8 Docker images** ([#17755](astral-sh/uv#17755)) The Debian Bookworm and Alpine 3.21 images were replaced by Debian Trixie and Alpine 3.22 as defaults in [uv 0.9](astral-sh/uv#15352). These older images are now removed. Python 3.8 images are also removed, as Python 3.8 is no longer supported in the Trixie or Alpine base images. The following image tags are no longer published: - `uv:bookworm`, `uv:bookworm-slim` - `uv:alpine3.21` - `uv:python3.8-*` Use `uv:debian` or `uv:trixie` instead of `uv:bookworm`, `uv:alpine` or `uv:alpine3.22` instead of `uv:alpine3.21`, and a newer Python version instead of `uv:python3.8-*`. - **Drop PPC64 (big endian) builds** ([#17626](astral-sh/uv#17626)) uv no longer provides pre-built binaries for PPC64 (big endian). This platform appears to be largely unused and is only supported on a single manylinux version. PPC64LE (little endian) builds are unaffected. Building uv from source is still supported for this platform. - **Skip generating `activate.csh` for relocatable virtual environments** ([#17759](astral-sh/uv#17759)) Previously, `uv venv --relocatable` would generate an `activate.csh` script that contained hardcoded paths, making it incompatible with relocation. Now, the `activate.csh` script is not generated for relocatable virtual environments. You cannot opt out of this behavior. - **Require username when multiple credentials match a URL** ([#16983](astral-sh/uv#16983)) When using `uv auth login` to store credentials, you can register multiple username and password combinations for the same host. Previously, when uv needed to authenticate and multiple credentials matched the URL (e.g., when retrieving a token with `uv auth token`), uv would pick the first match. Now, uv will error instead. You cannot opt out of this behavior. Include the username in the request, e.g., `uv auth token --username foo example.com`. - **Avoid invalidating the lockfile versions after an `exclude-newer` change** ([#17721](astral-sh/uv#17721)) Previously, changing the `exclude-newer` setting would cause package versions to be upgraded, ignoring the lockfile entirely. Now, uv will only change package versions if they are no longer within the `exclude-newer` range. You can restore the previous behavior by using `--upgrade` or `--upgrade-package` to opt-in to package version changes. - **Upgrade `uv format` to Ruff 0.15.0** ([#17838](astral-sh/uv#17838)) `uv format` now uses [Ruff 0.15.0](https://github.com/astral-sh/ruff/releases/tag/0.15.0), which uses the [2026 style guide](https://astral.sh/blog/ruff-v0.15.0#the-ruff-2026-style-guide). See the blog post for details. The formatting of code is likely to change. You can opt out of this behavior by requesting an older Ruff version, e.g., `uv format --version 0.14.14`. - **Update uv crate test features to use `test-` as a prefix** ([#17860](astral-sh/uv#17860)) This change only affects redistributors of uv. The Cargo features used to gate test dependencies, e.g., `pypi`, have been renamed with a `test-` prefix for clarity, e.g., `test-pypi`. ##### Stabilizations - **`uv python upgrade` and `uv python install --upgrade`** ([#17766](astral-sh/uv#17766)) When installing Python versions, an [intermediary directory](https://docs.astral.sh/uv/concepts/python-versions/#minor-version-directories) without the patch version attached will be created, and virtual environments will be transparently upgraded to new patch versions. See the [Python version documentation](https://docs.astral.sh/uv/concepts/python-versions/#upgrading-python-versions) for more details. - **`uv add --bounds` and the `add-bounds` configuration option** ([#17660](astral-sh/uv#17660)) This does not come with any behavior changes. You will no longer see an experimental warning when using `uv add --bounds` or `add-bounds` in configuration. - **`uv workspace list` and `uv workspace dir`** ([#17768](astral-sh/uv#17768)) This does not come with any behavior changes. You will no longer see an experimental warning when using these commands. - **`extra-build-dependencies`** ([#17767](astral-sh/uv#17767)) This does not come with any behavior changes. You will no longer see an experimental warning when using `extra-build-dependencies` in configuration. ##### Enhancements - Improve ABI tag error message phrasing ([#17878](astral-sh/uv#17878)) - Introduce a 10s connect timeout ([#17733](astral-sh/uv#17733)) - Allow using `pyx.dev` as a target in `uv auth` commands despite `PYX_API_URL` differing ([#17856](astral-sh/uv#17856)) ##### Bug fixes - Support all CPython ABI tag suffixes properly ([#17817](astral-sh/uv#17817)) - Add support for detecting PowerShell on Linux and macOS ([#17870](astral-sh/uv#17870)) - Retry timeout errors for streams ([#17875](astral-sh/uv#17875)) ### [`v0.9.30`](https://github.com/astral-sh/uv/releases/tag/0.9.30) [Compare Source](astral-sh/uv@0.9.29...0.9.30) #### Release Notes Released on 2026-02-04. ##### Python - Add CPython 3.14.3 and 3.13.12 ([#17849](astral-sh/uv#17849)) ##### Enhancements - Allow comma-separated values for `--extra` option ([#17525](astral-sh/uv#17525)) - Check all files during a dry-run publish instead of stopping at the first failure ([#17785](astral-sh/uv#17785)) - Clarify `UV_HTTP_TIMEOUT` error message ([#17493](astral-sh/uv#17493)) ##### Preview features - Use relocatable virtual environments by default ([#17770](astral-sh/uv#17770)) ##### Bug fixes - Fix deadlock on token refresh in `uv publish` when using pyx ([#17832](astral-sh/uv#17832)) - Ignore global Python pins when incompatible with project ([#15473](astral-sh/uv#15473)) #### Install uv 0.9.30 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.9.30/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.9.30/uv-installer.ps1 | iex" ``` #### Download uv 0.9.30 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-powerpc64-unknown-linux-gnu.tar.gz) | PPC64 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-powerpc64-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.30/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.9.29`](https://github.com/astral-sh/uv/releases/tag/0.9.29) [Compare Source](astral-sh/uv@0.9.28...0.9.29) #### Release Notes Released on 2026-02-03. ##### Python - Update to Pyodide 0.29.3 ([#17730](astral-sh/uv#17730)) ##### Enhancements - Add wheel-tag-style aliases for manylinux platform names ([#17750](astral-sh/uv#17750)) - Hint on `uv version --bump dev` similar to pre-release bumps ([#17796](astral-sh/uv#17796)) - Improve display of RFC 9457 Problem Detail responses in `uv publish` server errors ([#17787](astral-sh/uv#17787)) - Improve the wording of publish errors during dry-run ([#17782](astral-sh/uv#17782)) - Set backoff to 10 retries ([#17816](astral-sh/uv#17816)) - Add properties to synthentic and project roots in Cyclone DX exports ([#17820](astral-sh/uv#17820)) - Identify the invidividual clients in `uv publish` trace logs ([#17784](astral-sh/uv#17784)) ##### Preview features - Remove special casing for `base` and `default` conda environment names ([#17758](astral-sh/uv#17758)) ##### Bug fixes - Fix `PYTHONHOME` inheritance when spawning different Python versions ([#17821](astral-sh/uv#17821)) - Fix wheel rejections on freethreading+debug builds ([#17812](astral-sh/uv#17812)) - Pad with zeros during comparisons in `EqualStar` and `NotEqualStar` operators ([#17751](astral-sh/uv#17751)) - Reject unknown field names in conflict declarations ([#17727](astral-sh/uv#17727)) - Fix panics in `system-configuration` in sandboxes ([#17829](astral-sh/uv#17829)) ##### Documentation - Update pip pre-release compatibility information ([#17788](astral-sh/uv#17788)) ##### Security - Hide a subset of environment variable values in `--help` ([#17745](astral-sh/uv#17745)) #### Install uv 0.9.29 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.9.29/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.9.29/uv-installer.ps1 | iex" ``` #### Download uv 0.9.29 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-powerpc64-unknown-linux-gnu.tar.gz) | PPC64 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-powerpc64-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://github.com/astral-sh/uv/releases/download/0.9.29/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

zsol requested review from konstin and zanieb December 4, 2025 18:00

zsol mentioned this pull request Dec 4, 2025

Add a uv auth helper --protocol bazel command #16886

Merged

2 tasks

zsol temporarily deployed to uv-test-registries December 4, 2025 18:02 — with GitHub Actions Inactive

zsol force-pushed the zsol/jj-nyvrllosmoon branch from 3167ed6 to 0f74018 Compare December 4, 2025 18:23

zsol temporarily deployed to uv-test-registries December 4, 2025 18:26 — with GitHub Actions Inactive

zsol force-pushed the zsol/jj-nyvrllosmoon branch from 0f74018 to d270884 Compare December 4, 2025 18:33

zsol temporarily deployed to uv-test-registries December 4, 2025 18:35 — with GitHub Actions Inactive

zsol force-pushed the zsol/jj-qpnoslvrymlk branch from 5e10a51 to 4469013 Compare December 4, 2025 18:42

zsol force-pushed the zsol/jj-nyvrllosmoon branch from d270884 to ae53d40 Compare December 4, 2025 18:43

zsol temporarily deployed to uv-test-registries December 4, 2025 18:45 — with GitHub Actions Inactive

Base automatically changed from zsol/jj-qpnoslvrymlk to main December 4, 2025 18:56

zsol force-pushed the zsol/jj-nyvrllosmoon branch from ae53d40 to c8fa990 Compare December 4, 2025 19:02

zsol temporarily deployed to uv-test-registries December 4, 2025 19:03 — with GitHub Actions Inactive

zsol added bug Something isn't working breaking A breaking change labels Dec 4, 2025

zsol marked this pull request as ready for review December 4, 2025 19:08

zsol added this to the v0.10.0 milestone Jan 14, 2026

konstin approved these changes Jan 26, 2026

View reviewed changes

crates/uv-auth/src/middleware.rs Outdated Show resolved Hide resolved

zsol force-pushed the zsol/jj-nyvrllosmoon branch from c8fa990 to 3625ccd Compare January 29, 2026 10:24

zsol commented Jan 29, 2026

View reviewed changes

crates/uv-auth/src/middleware.rs Outdated Show resolved Hide resolved

zanieb changed the base branch from main to release/010 February 4, 2026 15:07

zsol added 2 commits February 4, 2026 09:08

Make TextCredentialStore.get_credentials fail on ambiguous matches

956e193

log the failure

bda4246

zanieb force-pushed the zsol/jj-nyvrllosmoon branch from 8cd8652 to bda4246 Compare February 4, 2026 15:08

zanieb merged commit 957ca38 into release/010 Feb 4, 2026
50 checks passed

zanieb deleted the zsol/jj-nyvrllosmoon branch February 4, 2026 15:14

BrewTestBot mentioned this pull request Feb 5, 2026

uv 0.10.0 Homebrew/homebrew-core#266096

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Bail when trying to attach ambiguous credentials instead of picking an arbitrary one#16983

Bail when trying to attach ambiguous credentials instead of picking an arbitrary one#16983
zanieb merged 2 commits intorelease/010from
zsol/jj-nyvrllosmoon

zsol commented Dec 4, 2025

Uh oh!

zsol commented Dec 4, 2025

Uh oh!

konstin commented Dec 5, 2025

Uh oh!

zanieb commented Dec 5, 2025

Uh oh!

konstin commented Dec 8, 2025 •

edited

Loading

Uh oh!

zanieb commented Dec 8, 2025

Uh oh!

zsol commented Dec 8, 2025

Uh oh!

Uh oh!

zsol left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

zsol commented Dec 4, 2025

Summary

Test Plan

Uh oh!

zsol commented Dec 4, 2025

Uh oh!

konstin commented Dec 5, 2025

Uh oh!

zanieb commented Dec 5, 2025

Uh oh!

konstin commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zanieb commented Dec 8, 2025

Uh oh!

zsol commented Dec 8, 2025

Uh oh!

Uh oh!

zsol left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

konstin commented Dec 8, 2025 •

edited

Loading