Support redirects in `uv publish` by dijor0310 · Pull Request #17130 · astral-sh/uv

dijor0310 · 2025-12-14T23:38:06Z

Summary

Follow redirects for uv publish. Fixes #17126.

Test Plan

Added a unit test to test the custom redirect logic.

konstin

Looks really good already!

We need one more addition for security: #17126 (comment)

konstin · 2025-12-15T15:31:50Z

crates/uv-publish/src/lib.rs

-        "The request was redirected, but redirects are not allowed when publishing, please use the canonical URL: `{0}`"
-    )]
-    RedirectError(Url),
+    #[error("Too many redirects: {0} (max number of redirects: {1})")]


In this error message, isn't the number of retry always the maximum number of redirects? i.e., can we say something like "Too many redirects, only {n_past_redirections} redirects are allowed"?

You're right, fixed :)

konstin · 2025-12-15T15:32:30Z

crates/uv-publish/src/lib.rs

            Ok(response) => {
+                // When the user accidentally uses https://test.pypi.org/legacy (no slash) as publish URL, we
+                // get a redirect to https://test.pypi.org/legacy/ (the canonical index URL).
+                // In the above case we get 308, reqwest or `RedirectClientWithMiddleware` would try


There is a word like a "where" missing

konstin · 2025-12-15T15:34:23Z

crates/uv-publish/src/lib.rs

+                    if let Some(location_header) = response.headers().get(LOCATION) {
+                        let location = location_header.to_str().unwrap();
+                        current_registry = DisplaySafeUrl::parse(location).unwrap();
+                        warn!("Redirecting the request to: {}", current_registry);


Suggested change

warn!("Redirecting the request to: {}", current_registry);

debug!("Redirecting the request to: {}", current_registry);

konstin · 2025-12-15T15:37:01Z

crates/uv-publish/src/lib.rs

+                        ));
+                    }
+                    if let Some(location_header) = response.headers().get(LOCATION) {
+                        let location = location_header.to_str().unwrap();


We can't unwrap here, we need to handle those errors gracefully. In uv production code, we need to avoid panics whenever possible; In this case, it's external input, so we have to assume it's in some way malformed.

Changed, please take a look

konstin · 2025-12-15T15:38:57Z

crates/uv-publish/src/lib.rs

+            .mount(&mock_server)
+            .await;
+
+        let group = {


nit: We don't need to have an inner block for the assignment, it can be let group = UploadDistribution.

dijor0310 · 2025-12-15T22:24:24Z

@konstin, added a check that the new URL is in the same realm:

...
if Realm::from(&current_registry) == Realm::from(registry) {
    debug!("Redirecting the request to: {}", current_registry);
    n_past_redirections += 1;
    continue;
}
...

konstin · 2025-12-16T08:39:57Z

Thanks for fixing!

I switched to explicit error types and added a test for infinite redirects.

konstin · 2025-12-16T08:47:05Z

I also added a test for the realm switch, since we consider that a security feature.

dijor0310 · 2025-12-16T10:18:27Z

Thanks for merging, @konstin!

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.9.17` -> `0.9.18` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.9.18`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0918) [Compare Source](astral-sh/uv@0.9.17...0.9.18) Released on 2025-12-16. ##### Enhancements - Add value hints to command line arguments to improve shell completion accuracy ([#17080](astral-sh/uv#17080)) - Improve error handling in `uv publish` ([#17096](astral-sh/uv#17096)) - Improve rendering of multiline error messages ([#17132](astral-sh/uv#17132)) - Support redirects in `uv publish` ([#17130](astral-sh/uv#17130)) - Include Docker images with the alpine version, e.g., `python3.x-alpine3.23` ([#17100](astral-sh/uv#17100)) ##### Configuration - Accept `--torch-backend` in `[tool.uv]` ([#17116](astral-sh/uv#17116)) ##### Performance - Speed up `uv cache size` ([#17015](astral-sh/uv#17015)) - Initialize S3 signer once ([#17092](astral-sh/uv#17092)) ##### Bug fixes - Avoid panics due to reads on failed requests ([#17098](astral-sh/uv#17098)) - Enforce latest-version in `@latest` requests ([#17114](astral-sh/uv#17114)) - Explicitly set `EntryType` for file entries in tar ([#17043](astral-sh/uv#17043)) - Ignore `pyproject.toml` index username in lockfile comparison ([#16995](astral-sh/uv#16995)) - Relax error when using `uv add` with `UV_GIT_LFS` set ([#17127](astral-sh/uv#17127)) - Support file locks on ExFAT on macOS ([#17115](astral-sh/uv#17115)) - Change schema for `exclude-newer` into optional string ([#17121](astral-sh/uv#17121)) ##### Documentation - Drop arm musl caveat from Docker documentation ([#17111](astral-sh/uv#17111)) - Fix version reference in resolver example ([#17085](astral-sh/uv#17085)) - Better documentation for `exclude-newer*` ([#17079](astral-sh/uv#17079)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

## Summary Follow redirects for `uv publish`. Related issue: astral-sh#17126. ## Test Plan  Added a unit test to test the custom redirect logic. --------- Co-authored-by: konstin <[email protected]>

dijor0310 force-pushed the diyor/add-redirect-uv-publish branch 2 times, most recently from b4b34b2 to 9495e20 Compare December 14, 2025 23:44

konstin changed the title ~~add redirect logic to uv publish~~ Support redirects in uv publish Dec 15, 2025

konstin added the enhancement New feature or improvement to existing functionality label Dec 15, 2025

konstin reviewed Dec 15, 2025

View reviewed changes

dijor0310 force-pushed the diyor/add-redirect-uv-publish branch 2 times, most recently from c94cf68 to 3be2223 Compare December 15, 2025 22:20

dijor0310 force-pushed the diyor/add-redirect-uv-publish branch from 3be2223 to 100be27 Compare December 15, 2025 22:34

support redirects in uv publish

424ba0b

dijor0310 force-pushed the diyor/add-redirect-uv-publish branch from 100be27 to 424ba0b Compare December 15, 2025 23:20

konstin added 2 commits December 16, 2025 09:25

Use properly typed errors

ac38635

Test infinite redirects

89af5dd

konstin approved these changes Dec 16, 2025

View reviewed changes

Add test for realm switches too

d98d050

konstin enabled auto-merge (squash) December 16, 2025 08:49

konstin merged commit b58f543 into astral-sh:main Dec 16, 2025
162 checks passed

BrewTestBot mentioned this pull request Dec 16, 2025

uv 0.9.18 Homebrew/homebrew-core#258895

Merged

	warn!("Redirecting the request to: {}", current_registry);
	debug!("Redirecting the request to: {}", current_registry);

Comments

Conversation

dijor0310 commented Dec 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test Plan

Uh oh!

konstin left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dijor0310 commented Dec 15, 2025

Uh oh!

konstin commented Dec 16, 2025

Uh oh!

konstin commented Dec 16, 2025

Uh oh!

Uh oh!

dijor0310 commented Dec 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dijor0310 commented Dec 14, 2025 •

edited

Loading