## Summary
This provides the scaffolding (CLI and initial `uv-audit` crate) for a
`uv audit` subcommand.
Closes#9189.
Tracking:
- [x] Core CLI scaffolding (this PR)
- [x] #18185
- [x] Audit core (probably a new `uv-audit` crate): #18124
- [ ] Bulk dependency audits with OSV
- [ ] Result presentation
- [ ] #18193
Things that also need to be done with the MVP:
- [ ] We should not audit workspace members by default (by definition,
they don't exist on indices and therefore don't have meaningful results
from vulnerability services).
- [ ] I need to ensure groups/etc. are being filtered by correctly,
right now we audit every single package in the lockfile unconditionally.
## Test Plan
Unit and integration tests commensurate with the new functionality.
---------
Signed-off-by: William Woodruff <william@astral.sh>
uv 0.10 can use direct builds for uv_build with `<0.10`, there were no
breaking changes.
This PR also revamps the direct build detection to be more sensitive and
improves the errors messages.
---------
Co-authored-by: Aria Desires <aria.desires@gmail.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [resvg](https://redirect.github.com/linebender/resvg) | dependencies |
minor | `0.46.0` → `0.47.0` |
---
### Release Notes
<details>
<summary>linebender/resvg (resvg)</summary>
###
[`v0.47.0`](https://redirect.github.com/linebender/resvg/blob/HEAD/CHANGELOG.md#0470-2026-02-05)
[Compare
Source](https://redirect.github.com/linebender/resvg/compare/v0.46.0...v0.47.0)
This release has an MSRV of 1.87.0 for `usvg` and `resvg` and the C API.
##### Added
- Focal radius (`fr`) supported for Radial Gradients.
([#​1014](https://redirect.github.com/linebender/resvg/issues/1014)
by [@​wmedrano](https://redirect.github.com/wmedrano))
- Support for variable fonts based on font-variation-settings CSS
property.
([#​997](https://redirect.github.com/linebender/resvg/issues/997)
by [@​oetiker](https://redirect.github.com/oetiker))
##### Changed
- `tiny-skia` has a major version bump from 0.11 to 0.12.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
|
[target-lexicon](https://redirect.github.com/bytecodealliance/target-lexicon)
| workspace.dependencies | patch | `0.13.4` → `0.13.5` |
---
### Release Notes
<details>
<summary>bytecodealliance/target-lexicon (target-lexicon)</summary>
###
[`v0.13.5`](https://redirect.github.com/bytecodealliance/target-lexicon/compare/v0.13.4...v0.13.5)
[Compare
Source](https://redirect.github.com/bytecodealliance/target-lexicon/compare/v0.13.4...v0.13.5)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [syn](https://redirect.github.com/dtolnay/syn) |
workspace.dependencies | patch | `2.0.114` → `2.0.116` | `2.0.117` |
---
### Release Notes
<details>
<summary>dtolnay/syn (syn)</summary>
###
[`v2.0.116`](https://redirect.github.com/dtolnay/syn/releases/tag/2.0.116)
[Compare
Source](https://redirect.github.com/dtolnay/syn/compare/2.0.115...2.0.116)
- Optimize parse\_fn\_arg\_or\_variadic for less lookahead on erroneous
receiver
([#​1968](https://redirect.github.com/dtolnay/syn/issues/1968))
###
[`v2.0.115`](https://redirect.github.com/dtolnay/syn/releases/tag/2.0.115)
[Compare
Source](https://redirect.github.com/dtolnay/syn/compare/2.0.114...2.0.115)
- Enable GenericArgument::Constraint parsing in non-full mode
([#​1966](https://redirect.github.com/dtolnay/syn/issues/1966))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [rkyv](https://redirect.github.com/rkyv/rkyv) | workspace.dependencies
| patch | `0.8.14` → `0.8.15` |
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [ctrlc](https://redirect.github.com/Detegr/rust-ctrlc) |
workspace.dependencies | patch | `3.5.1` → `3.5.2` |
---
### Release Notes
<details>
<summary>Detegr/rust-ctrlc (ctrlc)</summary>
###
[`v3.5.2`](https://redirect.github.com/Detegr/rust-ctrlc/compare/3.5.1...3.5.2)
[Compare
Source](https://redirect.github.com/Detegr/rust-ctrlc/compare/3.5.1...3.5.2)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [predicates](https://redirect.github.com/assert-rs/predicates-rs) |
workspace.dependencies | patch | `3.1.3` → `3.1.4` |
---
### Release Notes
<details>
<summary>assert-rs/predicates-rs (predicates)</summary>
###
[`v3.1.4`](https://redirect.github.com/assert-rs/predicates-rs/blob/HEAD/CHANGELOG.md#314---2026-02-11)
[Compare
Source](https://redirect.github.com/assert-rs/predicates-rs/compare/v3.1.3...v3.1.4)
- Make `BoxPredicate::find_case` use the inner `find_case`
implementation
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [goblin](https://redirect.github.com/m4b/goblin) |
workspace.dependencies | patch | `0.10.4` → `0.10.5` |
---
### Release Notes
<details>
<summary>m4b/goblin (goblin)</summary>
###
[`v0.10.5`](https://redirect.github.com/m4b/goblin/blob/HEAD/CHANGELOG.md#0105---2026-2-11)
#### \[0.10.5] - 2026-2-11
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [env_logger](https://redirect.github.com/rust-cli/env_logger) |
dev-dependencies | patch | `0.11.8` → `0.11.9` |
---
### Release Notes
<details>
<summary>rust-cli/env_logger (env_logger)</summary>
###
[`v0.11.9`](https://redirect.github.com/rust-cli/env_logger/blob/HEAD/CHANGELOG.md#0119---2026-02-11)
[Compare
Source](https://redirect.github.com/rust-cli/env_logger/compare/v0.11.8...v0.11.9)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [jiff](https://redirect.github.com/BurntSushi/jiff) |
workspace.dependencies | patch | `0.2.19` → `0.2.20` | `0.2.21` |
---
### Release Notes
<details>
<summary>BurntSushi/jiff (jiff)</summary>
###
[`v0.2.20`](https://redirect.github.com/BurntSushi/jiff/blob/HEAD/CHANGELOG.md#0220-2026-02-11)
[Compare
Source](https://redirect.github.com/BurntSushi/jiff/compare/0.2.19...0.2.20)
\===================
This release contains a major internal refactor that moves off of using
ranged
integers internally. There are also some small bug fixes and added
support for
finding the system time zone on emscripten targets.
Enhancements:
- [#​11](https://redirect.github.com/BurntSushi/jiff/issues/11):
Stop using ranged integers internally.
- [#​490](https://redirect.github.com/BurntSushi/jiff/issues/490):
Add support for retrieving the system time zone on emscripten targets.
- [#​500](https://redirect.github.com/BurntSushi/jiff/issues/500):
Update comparison with the `time` crate in the Jiff documentation.
- [#​502](https://redirect.github.com/BurntSushi/jiff/issues/502):
Enable some non-default features for the Rust Playground deployment.
Bug fixes:
- [#​485](https://redirect.github.com/BurntSushi/jiff/issues/485):
Fix bug with padding for negative integers in `strftime`.
- [#​486](https://redirect.github.com/BurntSushi/jiff/issues/486):
Make `%^c` result in uppercase strings where appropriate.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1yZWxlYXNlIiwiaW50ZXJuYWwiXX0=-->
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Zanie Blue <contact@zanie.dev>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [tempfile](https://stebalien.com/projects/tempfile-rs/)
([source](https://redirect.github.com/Stebalien/tempfile)) |
workspace.dependencies | minor | `3.24.0` → `3.25.0` |
---
### Release Notes
<details>
<summary>Stebalien/tempfile (tempfile)</summary>
###
[`v3.25.0`](https://redirect.github.com/Stebalien/tempfile/blob/HEAD/CHANGELOG.md#3250)
- Allow `getrandom` 0.4.x while retaining support for `getrandom` 0.3.x.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1yZWxlYXNlIiwiaW50ZXJuYWwiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [security-framework](https://lib.rs/crates/security_framework)
([source](https://redirect.github.com/kornelski/rust-security-framework))
| workspace.dependencies | minor | `3.5.1` → `3.6.0` | `3.7.0` |
---
### Release Notes
<details>
<summary>kornelski/rust-security-framework
(security-framework)</summary>
###
[`v3.6.0`](https://redirect.github.com/kornelski/rust-security-framework/compare/v3.5.1...v3.6.0)
[Compare
Source](https://redirect.github.com/kornelski/rust-security-framework/compare/v3.5.1...v3.6.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1yZWxlYXNlIiwiaW50ZXJuYWwiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [anstream](https://redirect.github.com/rust-cli/anstyle) |
workspace.dependencies | major | `0.6.15` → `1.0.0` |
---
### Release Notes
<details>
<summary>rust-cli/anstyle (anstream)</summary>
###
[`v1.0.0`](https://redirect.github.com/rust-cli/anstyle/compare/anstyle-parse-v0.2.7...anstyle-parse-v1.0.0)
[Compare
Source](https://redirect.github.com/rust-cli/anstyle/compare/anstream-v0.6.21...anstream-v1.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1yZWxlYXNlIiwiaW50ZXJuYWwiXX0=-->
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: konstin <konstin@mailbox.org>
Consolidates our file copying and linking logic in `uv-fs` instead of
having a duplicate implementation in `uv-install-wheel`. This required
introducing some new abstractions in `uv-fs` to support the features
wheel installation needs.
I think this is a blocker to improving our reflink handling in
https://github.com/astral-sh/uv/pull/17753 and also generally desirable
since the copy fallback logic is complicated.
This PR contains the following updates:
| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [jiff](https://redirect.github.com/BurntSushi/jiff) |
workspace.dependencies | patch | `0.2.18` → `0.2.19` | `0.2.20` |
---
### Release Notes
<details>
<summary>BurntSushi/jiff (jiff)</summary>
###
[`v0.2.19`](https://redirect.github.com/BurntSushi/jiff/blob/HEAD/CHANGELOG.md#0219-2026-02-05)
[Compare
Source](https://redirect.github.com/BurntSushi/jiff/compare/0.2.18...0.2.19)
\===================
This is a small release with a performance optimization (with respect to
doing
heavily contended arithmetic on `Zoned` values) and a bug fix for a
panic
that can occur when using `%2s` in `strftime`.
Enhancements:
- [#​491](https://redirect.github.com/BurntSushi/jiff/issues/491):
Avoid cloning `TimeZone` for consuming operations on `Zoned`.
Bug fixes:
- [#​497](https://redirect.github.com/BurntSushi/jiff/issues/497):
Fix a panic in `timestamp.strftime("%2s")`.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44LjUiLCJ1cGRhdGVkSW5WZXIiOiI0My44LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Tomasz (Tom) Kramkowski <tom@astral.sh>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [anyhow](https://redirect.github.com/dtolnay/anyhow) |
workspace.dependencies | patch | `1.0.100` → `1.0.101` |
---
### Release Notes
<details>
<summary>dtolnay/anyhow (anyhow)</summary>
###
[`v1.0.101`](https://redirect.github.com/dtolnay/anyhow/releases/tag/1.0.101)
[Compare
Source](https://redirect.github.com/dtolnay/anyhow/compare/1.0.100...1.0.101)
- Add #\[inline] to anyhow::Ok helper
([#​437](https://redirect.github.com/dtolnay/anyhow/issues/437),
thanks [@​Ibitier](https://redirect.github.com/Ibitier))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44LjUiLCJ1cGRhdGVkSW5WZXIiOiI0My44LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
|
[regex-automata](https://redirect.github.com/rust-lang/regex/tree/master/regex-automata)
([source](https://redirect.github.com/rust-lang/regex)) |
workspace.dependencies | patch | `0.4.13` → `0.4.14` |
---
### Release Notes
<details>
<summary>rust-lang/regex (regex-automata)</summary>
###
[`v0.4.14`](https://redirect.github.com/rust-lang/regex/compare/regex-automata-0.4.13...regex-automata-0.4.14)
[Compare
Source](https://redirect.github.com/rust-lang/regex/compare/regex-automata-0.4.13...regex-automata-0.4.14)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44LjUiLCJ1cGRhdGVkSW5WZXIiOiI0My44LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [tracing-test](https://redirect.github.com/dbrgn/tracing-test) |
workspace.dependencies | patch | `0.2.5` → `0.2.6` |
---
### Release Notes
<details>
<summary>dbrgn/tracing-test (tracing-test)</summary>
###
[`v0.2.6`](https://redirect.github.com/dbrgn/tracing-test/blob/HEAD/CHANGELOG.md#026---2026-02-08)
[Compare
Source](https://redirect.github.com/dbrgn/tracing-test/compare/v0.2.5...v0.2.6)
- \[change] Enforce version equality between tracing-test and
tracing-test-macro
([#​57](https://redirect.github.com/dbrgn/tracing-test/issues/57))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44LjUiLCJ1cGRhdGVkSW5WZXIiOiI0My44LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [fs-err](https://redirect.github.com/andrewhickman/fs-err) |
workspace.dependencies | minor | `3.2.2` → `3.3.0` |
---
### Release Notes
<details>
<summary>andrewhickman/fs-err (fs-err)</summary>
###
[`v3.3.0`](https://redirect.github.com/andrewhickman/fs-err/compare/3.2.2...3.3.0)
[Compare
Source](https://redirect.github.com/andrewhickman/fs-err/compare/3.2.2...3.3.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44LjUiLCJ1cGRhdGVkSW5WZXIiOiI0My44LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [regex](https://redirect.github.com/rust-lang/regex) |
workspace.dependencies | patch | `1.12.2` → `1.12.3` |
---
### Release Notes
<details>
<summary>rust-lang/regex (regex)</summary>
###
[`v1.12.3`](https://redirect.github.com/rust-lang/regex/blob/HEAD/CHANGELOG.md#1123-2025-02-03)
[Compare
Source](https://redirect.github.com/rust-lang/regex/compare/1.12.2...1.12.3)
\===================
This release excludes some unnecessary things from the archive published
to
crates.io. Specifically, fuzzing data and various shell scripts are now
excluded. If you run into problems, please file an issue.
Improvements:
- [#​1319](https://redirect.github.com/rust-lang/regex/pull/1319):
Switch from a Cargo `exclude` list to an `include` list, and exclude
some
unnecessary stuff.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44LjUiLCJ1cGRhdGVkSW5WZXIiOiI0My44LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [memchr](https://redirect.github.com/BurntSushi/memchr) |
workspace.dependencies | minor | `2.7.6` → `2.8.0` |
---
### Release Notes
<details>
<summary>BurntSushi/memchr (memchr)</summary>
###
[`v2.8.0`](https://redirect.github.com/BurntSushi/memchr/compare/2.7.6...2.8.0)
[Compare
Source](https://redirect.github.com/BurntSushi/memchr/compare/2.7.6...2.8.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44LjUiLCJ1cGRhdGVkSW5WZXIiOiI0My44LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImJ1aWxkOnNraXAtcmVsZWFzZSIsImludGVybmFsIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
The downside here is that we lose `https://` coverage, but I think it's
worth it.
We've seen frequent test disruptions from fly.io being down, and it's
always better for the test suite to be more self-contained. These test
cases predated us having wiremock patterns in the suite, but now it's
common.
For https://github.com/astral-sh/uv/issues/17964 /
https://github.com/astral-sh/uv/pull/17965. Logging now gets initialized
earlier to cover more of the startup procedure.
Also decrease the log level for lock acquisition from debug to trace,
that happy path usually isn't relevant.
```
$ cargo run -q pip install tqdm -v
DEBUG uv 0.10.2+7 (cc6e7a600 2026-02-11)
DEBUG Searching for default Python interpreter in virtual environments
DEBUG Found `cpython-3.14.0-linux-x86_64-gnu` at `/home/konsti/projects/uv/.venv/bin/python3` (virtual environment)
DEBUG Using Python 3.14.0 environment at: .venv
DEBUG Requirement satisfied: tqdm
Audited 1 package in 2ms
```
```
$ cargo run -q pip install tqdm -v --preview
DEBUG uv 0.10.2+7 (cc6e7a600 2026-02-11)
DEBUG All preview features are enabled
DEBUG Searching for default Python interpreter in virtual environments
DEBUG Found `cpython-3.14.0-linux-x86_64-gnu` at `/home/konsti/projects/uv/.venv/bin/python3` (virtual environment)
DEBUG Using Python 3.14.0 environment at: .venv
DEBUG Requirement satisfied: tqdm
Audited 1 package in 2ms
```
```
$ cargo run -q pip install tqdm -v --preview-features target-workspace-discovery
DEBUG uv 0.10.2+7 (cc6e7a600 2026-02-11)
DEBUG The following preview features are enabled: target-workspace-discovery
DEBUG Searching for default Python interpreter in virtual environments
DEBUG Found `cpython-3.14.0-linux-x86_64-gnu` at `/home/konsti/projects/uv/.venv/bin/python3` (virtual environment)
DEBUG Using Python 3.14.0 environment at: .venv
DEBUG Requirement satisfied: tqdm
Audited 1 package in 1ms
```
This PR contains the following updates:
| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [clap](https://redirect.github.com/clap-rs/clap) |
workspace.dependencies | patch | `4.5.54` → `4.5.57` | `4.5.58` |
---
### Release Notes
<details>
<summary>clap-rs/clap (clap)</summary>
###
[`v4.5.57`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#4557---2026-02-03)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.5.56...v4.5.57)
##### Fixes
- Regression from 4.5.55 where having an argument with
`.value_terminator("--")` caused problems with an argument with
`.last(true)`
###
[`v4.5.56`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#4556---2026-01-29)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.5.55...v4.5.56)
##### Fixes
- On conflict error, don't show conflicting arguments in the usage
###
[`v4.5.55`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#4555---2026-01-27)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.5.54...v4.5.55)
##### Fixes
- Fix inconsistency in precedence between positionals with a
`value_terminator("--")` and escapes (`--`) where `./foo -- bar` means
the first arg is empty, rather than escaping future args
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45NS4yIiwidXBkYXRlZEluVmVyIjoiNDIuOTcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1yZWxlYXNlIiwiaW50ZXJuYWwiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
William Woodruff