PublicArchive/astral-uv
2
0
Fork 0
mirror of https://github.com/astral-sh/uv.git synced 2026-05-06 08:56:53 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
b6854d77bfd0cb78157fecaf8b30126c6f16bc11
astral-uv/Cargo.toml
T
Zanie Blue b6854d77bf Upgrade reqwest to 0.13 (#18550) 
The following user-facing changes are included here:

- `aws-lc` is used instead of `ring` for a cryptography backend
- Expands our certificate signature algorithm support to include
ECDSA_P256_SHA512, ECDSA_P384_SHA512, ECDSA_P521_SHA256,
ECDSA_P521_SHA384, and ECDSA_P521_SHA512
- `--native-tls` is deprecated in favor of a new `--system-certs` flag,
avoiding confusion with the TLS implementation used (we use `rustls` not
`native-tls`, see prior confusion at
https://github.com/astral-sh/uv/issues/11595)
- NASM is a new build requirement on Windows, it is required by `aws-lc`
on x86-64 and i386
- `rustls-platform-verifier` is used instead of `rustls-native-certs`
for system certificate verification
- On macOS, certificate validation is now delegated to
`Security.framework` (`SecTrust`). Performance when using
`--system-certs` is improved by avoiding exporting and parsing all the
certificates from the keychain at startup.
- On Windows, certificate validation is now delegated to
`CertGetCertificateChain` and `CertVerifyCertificateChainPolicy`
    - On Linux, certificate validation should be approximately unchanged
- Some previously failing chains may succeed, and some previously
accepted chains may fail; generally, this should result in behavior
closer matching browsers and other native applications
- macOS and Windows may now perform live OCSP fetches for early
revocation, which could add latency to some requests
- Empty `SSL_CERT_FILE` values are ignored (for consistency with
`SSL_CERT_DIR`)

The following internal changes are included here:

- Certificate loading has been refactored to use a newtype with helper
methods
- The certificate tests have been rewritten
- We use `webpki-root-certs` instead of `webpki-roots`, see
https://github.com/astral-sh/uv/pull/17543#discussion_r2820187691
- We request `identity` encoding for range requests, see
https://github.com/astral-sh/async_http_range_reader/pull/3#discussion_r2700194798
- Various dependencies (including forks) updates to versions which use
reqwest 0.13+

This is a replacement of #17543 with an updated description. See that
pull request for prior discussion. I've made the following changes from
the initial approach there:

- Previously, the `native-tls` TLS implementation was added which
included an OpenSSL build. We don't currently use the `native-tls`
implementation, but the `--native-tls` flag there was erroneously
updated to enable it.
- Previously, there was a `--tls-backend` flag to toggle between
`native-tls` and `rustls`. Since we currently always use `rustls`, this
is deferred to future work (if we need it at all).
- Previously, there were unintentional breaking changes to
`SSL_CERT_FILE` and `SSL_CERT_DIR` handling, including merging with the
base certificates instead of replacing them, dropping support for
OpenSSL hash-named certificate files, skipping deduplication of
certificates. Here, we retain use of `rustls-native-certs` for loading
certificates from the system as it handles these edge cases.


Closes https://github.com/astral-sh/uv/issues/17427

---------

Co-authored-by: salmonsd <22984014+salmonsd@users.noreply.github.com>
2026-03-23 13:22:19 -05:00

454 lines
16 KiB
TOML
Raw Blame History

[workspace]
members = ["crates/*"]
exclude = [
"scripts",
# Needs nightly
"crates/uv-trampoline",
]
resolver = "2"
[workspace.package]
edition = "2024"
rust-version = "1.92.0"
homepage = "https://pypi.org/project/uv/"
repository = "https://github.com/astral-sh/uv"
authors = ["uv"]
license = "MIT OR Apache-2.0"
[workspace.dependencies]
uv-audit = { version = "0.0.32", path = "crates/uv-audit" }
uv-auth = { version = "0.0.32", path = "crates/uv-auth" }
uv-bin-install = { version = "0.0.32", path = "crates/uv-bin-install" }
uv-build-backend = { version = "0.0.32", path = "crates/uv-build-backend" }
uv-build-frontend = { version = "0.0.32", path = "crates/uv-build-frontend" }
uv-cache = { version = "0.0.32", path = "crates/uv-cache" }
uv-cache-info = { version = "0.0.32", path = "crates/uv-cache-info" }
uv-cache-key = { version = "0.0.32", path = "crates/uv-cache-key" }
uv-cli = { version = "0.0.32", path = "crates/uv-cli" }
uv-client = { version = "0.0.32", path = "crates/uv-client" }
uv-configuration = { version = "0.0.32", path = "crates/uv-configuration" }
uv-console = { version = "0.0.32", path = "crates/uv-console" }
uv-dirs = { version = "0.0.32", path = "crates/uv-dirs" }
uv-dispatch = { version = "0.0.32", path = "crates/uv-dispatch" }
uv-distribution = { version = "0.0.32", path = "crates/uv-distribution" }
uv-distribution-filename = { version = "0.0.32", path = "crates/uv-distribution-filename" }
uv-distribution-types = { version = "0.0.32", path = "crates/uv-distribution-types" }
uv-extract = { version = "0.0.32", path = "crates/uv-extract" }
uv-flags = { version = "0.0.32", path = "crates/uv-flags" }
uv-fs = { version = "0.0.32", path = "crates/uv-fs", features = [
"serde",
"tokio",
] }
uv-git = { version = "0.0.32", path = "crates/uv-git" }
uv-git-types = { version = "0.0.32", path = "crates/uv-git-types" }
uv-globfilter = { version = "0.0.32", path = "crates/uv-globfilter" }
uv-install-wheel = { version = "0.0.32", path = "crates/uv-install-wheel", default-features = false }
uv-installer = { version = "0.0.32", path = "crates/uv-installer" }
uv-keyring = { version = "0.0.32", path = "crates/uv-keyring" }
uv-logging = { version = "0.0.32", path = "crates/uv-logging" }
uv-macros = { version = "0.0.32", path = "crates/uv-macros" }
uv-metadata = { version = "0.0.32", path = "crates/uv-metadata" }
uv-normalize = { version = "0.0.32", path = "crates/uv-normalize" }
uv-once-map = { version = "0.0.32", path = "crates/uv-once-map" }
uv-options-metadata = { version = "0.0.32", path = "crates/uv-options-metadata" }
uv-performance-memory-allocator = { version = "0.0.32", path = "crates/uv-performance-memory-allocator" }
uv-pep440 = { version = "0.0.32", path = "crates/uv-pep440", features = [
"tracing",
"rkyv",
"version-ranges",
] }
uv-pep508 = { version = "0.0.32", path = "crates/uv-pep508", features = [
"non-pep508-extensions",
] }
uv-platform = { version = "0.0.32", path = "crates/uv-platform" }
uv-platform-tags = { version = "0.0.32", path = "crates/uv-platform-tags" }
uv-preview = { version = "0.0.32", path = "crates/uv-preview" }
uv-publish = { version = "0.0.32", path = "crates/uv-publish" }
uv-pypi-types = { version = "0.0.32", path = "crates/uv-pypi-types" }
uv-python = { version = "0.0.32", path = "crates/uv-python" }
uv-redacted = { version = "0.0.32", path = "crates/uv-redacted" }
uv-requirements = { version = "0.0.32", path = "crates/uv-requirements" }
uv-requirements-txt = { version = "0.0.32", path = "crates/uv-requirements-txt" }
uv-resolver = { version = "0.0.32", path = "crates/uv-resolver" }
uv-scripts = { version = "0.0.32", path = "crates/uv-scripts" }
uv-settings = { version = "0.0.32", path = "crates/uv-settings" }
uv-shell = { version = "0.0.32", path = "crates/uv-shell" }
uv-small-str = { version = "0.0.32", path = "crates/uv-small-str" }
uv-state = { version = "0.0.32", path = "crates/uv-state" }
uv-static = { version = "0.0.32", path = "crates/uv-static" }
uv-test = { version = "0.0.32", path = "crates/uv-test" }
uv-tool = { version = "0.0.32", path = "crates/uv-tool" }
uv-torch = { version = "0.0.32", path = "crates/uv-torch" }
uv-trampoline-builder = { version = "0.0.32", path = "crates/uv-trampoline-builder" }
uv-types = { version = "0.0.32", path = "crates/uv-types" }
uv-unix = { version = "0.0.32", path = "crates/uv-unix" }
uv-version = { version = "0.10.12", path = "crates/uv-version" }
uv-virtualenv = { version = "0.0.32", path = "crates/uv-virtualenv" }
uv-warnings = { version = "0.0.32", path = "crates/uv-warnings" }
uv-windows = { version = "0.0.32", path = "crates/uv-windows" }
uv-workspace = { version = "0.0.32", path = "crates/uv-workspace" }
ambient-id = { version = "0.0.11", default-features = false, features = [
"reqwest-middleware",
] }
anstream = { version = "1.0.0" }
anyhow = { version = "1.0.89" }
arcstr = { version = "1.2.0" }
arrayvec = { version = "0.7.6" }
astral-tokio-tar = { version = "0.6.0" }
async-channel = { version = "2.3.1" }
async-compression = { version = "0.4.12", features = [
"bzip2",
"gzip",
"xz",
"zstd",
] }
async-trait = { version = "0.1.82" }
async_http_range_reader = { version = "0.10.0", package = "astral_async_http_range_reader" }
async_zip = { version = "0.0.17", package = "astral_async_zip", features = [
"bzip2",
"deflate",
"lzma",
"tokio",
"xz",
"zstd",
] }
axoupdater = { version = "0.10.0", default-features = false }
backon = { version = "1.3.0" }
base64 = { version = "0.22.1" }
bitflags = { version = "2.6.0" }
blake2 = { version = "0.10.6" }
boxcar = { version = "0.2.5" }
bytecheck = { version = "0.8.0" }
cargo-util = { version = "0.2.14" }
clap = { version = "4.5.17", features = [
"derive",
"env",
"string",
"wrap_help",
] }
clap_complete_command = { version = "0.6.1" }
configparser = { version = "3.1.0" }
console = { version = "0.16.0", default-features = false, features = ["std"] }
csv = { version = "1.3.0" }
ctrlc = { version = "3.4.5" }
cyclonedx-bom = { version = "0.8.0" }
dashmap = { version = "6.1.0" }
data-encoding = { version = "2.6.0" }
diskus = { version = "0.9.0", default-features = false }
dotenvy = { version = "0.15.7" }
dunce = { version = "1.0.5" }
either = { version = "1.13.0" }
encoding_rs_io = { version = "0.1.7" }
embed-manifest = { version = "1.5.0" }
enumflags2 = { version = "0.7.12" }
etcetera = { version = "0.11.0" }
fastrand = { version = "2.3.0" }
flate2 = { version = "1.0.33", default-features = false, features = [
"zlib-rs",
] }
fs-err = { version = "3.2.2", features = ["tokio"] }
futures = { version = "0.3.30" }
glob = { version = "0.3.1" }
globset = { version = "0.4.15" }
globwalk = { version = "0.9.1" }
goblin = { version = "0.10.0", default-features = false, features = [
"std",
"elf32",
"elf64",
"endian_fd",
] }
h2 = { version = "0.4.7" }
hashbrown = { version = "0.16.0" }
hex = { version = "0.4.3" }
html-escape = { version = "0.2.13" }
http = { version = "1.1.0" }
indexmap = { version = "2.5.0" }
indicatif = { version = "0.18.0" }
indoc = { version = "2.0.5" }
itertools = { version = "0.14.0" }
jiff = { version = "0.2.0", features = ["serde"] }
junction = { version = "1.4.2" }
mailparse = { version = "0.16.0" }
md-5 = { version = "0.10.6" }
memchr = { version = "2.7.4" }
miette = { version = "7.2.0", features = ["fancy-no-backtrace"] }
nanoid = { version = "0.4.0" }
nix = { version = "0.31.2", features = ["resource", "signal"] }
open = { version = "5.3.2" }
owo-colors = { version = "4.1.0" }
path-slash = { version = "0.2.1" }
pathdiff = { version = "0.2.1" }
percent-encoding = { version = "2.3.1" }
petgraph = { version = "0.8.0" }
proc-macro2 = { version = "1.0.86" }
procfs = { version = "0.18.0", default-features = false, features = ["flate2"] }
pubgrub = { version = "0.3.3", package = "astral-pubgrub" }
quote = { version = "1.0.37" }
rayon = { version = "1.10.0" }
ref-cast = { version = "1.0.24" }
reflink-copy = { version = "0.1.19" }
regex = { version = "1.10.6" }
regex-automata = { version = "0.4.8", default-features = false, features = [
"dfa-build",
"dfa-search",
"perf",
"std",
"syntax",
] }
reqsign = { version = "0.19.0", features = [
"aws",
"google",
"default-context",
], default-features = false }
reqwest = { version = "0.13.1", default-features = false, features = [
"json",
"gzip",
"deflate",
"zstd",
"stream",
"system-proxy",
"rustls",
"socks",
"multipart",
"http2",
"blocking",
"query",
"form",
] }
reqwest-middleware = { version = "0.5.1", package = "astral-reqwest-middleware", features = [
"multipart",
"query",
] }
reqwest-retry = { version = "0.9.1", package = "astral-reqwest-retry", features = [
"tracing",
] }
rkyv = { version = "0.8.14", features = ["bytecheck"] }
rmp-serde = { version = "1.3.0" }
rust-netrc = { version = "0.1.2" }
rustc-hash = { version = "2.0.0" }
rustls-native-certs = { version = "0.8.3" }
rustls-pki-types = { version = "1.14.0" }
rustix = { version = "1.0.0", default-features = false, features = [
"fs",
"std",
"system",
] }
same-file = { version = "1.0.6" }
schemars = { version = "1.0.0", features = ["url2"] }
seahash = { version = "4.1.0" }
secret-service = { version = "5.0.0", features = ["rt-tokio-crypto-rust"] }
security-framework = { version = "3" }
self-replace = { version = "1.5.0" }
serde = { version = "1.0.210", features = ["derive", "rc"] }
serde-untagged = { version = "0.1.6" }
serde_json = { version = "1.0.128" }
sha2 = { version = "0.10.8" }
smallvec = { version = "1.13.2" }
spdx = { version = "0.13.0" }
syn = { version = "2.0.77" }
tar = { version = "0.4.43" }
target-lexicon = { version = "0.13.0" }
tempfile = { version = "3.14.0" }
textwrap = { version = "0.16.1" }
thiserror = { version = "2.0.0" }
astral-tl = { version = "0.7.11" }
tokio = { version = "1.40.0", features = [
"fs",
"io-util",
"macros",
"process",
"rt",
"signal",
"sync",
"time",
] }
tokio-stream = { version = "0.1.16" }
tokio-util = { version = "0.7.12", features = ["compat", "io"] }
toml = { version = "0.9.2", features = ["fast_hash"] }
toml_edit = { version = "0.24.0", features = ["serde"] }
tracing = { version = "0.1.40" }
tracing-durations-export = { version = "0.3.0", features = ["plot"] }
tracing-subscriber = { version = "0.3.18" } # Default feature set for uv_build, uv activates extra features
tracing-test = { version = "0.2.5" }
tracing-tree = { version = "0.4.0" }
unicode-width = { version = "0.2.0" }
unscanny = { version = "0.1.0" }
url = { version = "2.5.2", features = ["serde"] }
uuid = { version = "1.16.0" }
version-ranges = { version = "0.1.3", package = "astral-version-ranges" }
walkdir = { version = "2.5.0" }
webpki-root-certs = { version = "1" }
which = { version = "8.0.0", features = ["regex"] }
windows = { version = "0.61.0", features = [
"std",
"Win32_Foundation",
"Win32_Globalization",
"Win32_Security",
"Win32_Storage_FileSystem",
"Win32_System_Console",
"Win32_System_Diagnostics_Debug",
"Win32_System_Environment",
"Win32_System_IO",
"Win32_System_Ioctl",
"Win32_System_JobObjects",
"Win32_System_Kernel",
"Win32_System_LibraryLoader",
"Win32_System_Registry",
"Win32_System_Threading",
"Win32_UI_WindowsAndMessaging",
] }
windows-registry = { version = "0.5.0" }
windows-version = { version = "0.1.6" }
wiremock = { version = "0.6.4" }
wmi = { version = "0.18.3", default-features = false }
xz2 = { version = "0.1.7", features = ["static"] }
zeroize = { version = "1.8.1" }
zip = { version = "8.1.0", default-features = false, features = [
"deflate",
"zstd",
"bzip2",
"lzma",
"xz",
] }
zstd = { version = "0.13.3" }
# dev-dependencies
assert_cmd = { version = "2.0.16" }
assert_fs = { version = "1.1.2" }
byteorder = { version = "1.5.0" }
bytes = { version = "1.10.1" }
filetime = { version = "0.2.25" }
http-body-util = { version = "0.1.2" }
hyper = { version = "1.4.1", features = ["server", "http1"] }
hyper-util = { version = "0.1.8", features = ["tokio", "server", "http1"] }
ignore = { version = "0.4.23" }
insta = { version = "1.46.0", features = ["json", "filters", "redactions"] }
predicates = { version = "3.1.2" }
rcgen = { version = "0.14.5", features = [
"crypto",
"pem",
"ring",
], default-features = false }
rustls = { version = "0.23.36", default-features = false }
similar = { version = "2.6.0" }
temp-env = { version = "0.3.6", features = ["async_closure"] }
test-case = { version = "3.3.1" }
test-log = { version = "0.2.16", features = [
"trace",
], default-features = false }
tokio-rustls = { version = "0.26.2", default-features = false }
whoami = { version = "2.0.0" }
[workspace.lints.rust]
unsafe_code = "warn"
unreachable_pub = "warn"
[workspace.lints.clippy]
pedantic = { level = "warn", priority = -2 }
# Allowed pedantic lints
char_lit_as_u8 = "allow"
collapsible_else_if = "allow"
collapsible_if = "allow"
implicit_hasher = "allow"
map_unwrap_or = "allow"
match_same_arms = "allow"
missing_errors_doc = "allow"
missing_panics_doc = "allow"
module_name_repetitions = "allow"
must_use_candidate = "allow"
similar_names = "allow"
struct_excessive_bools = "allow"
too_many_arguments = "allow"
too_many_lines = "allow"
used_underscore_binding = "allow"
# Disallowed restriction lints
print_stdout = "warn"
print_stderr = "warn"
dbg_macro = "warn"
empty_drop = "warn"
empty_structs_with_brackets = "warn"
exit = "warn"
get_unwrap = "warn"
rc_buffer = "warn"
rc_mutex = "warn"
rest_pat_in_fully_bound_structs = "warn"
if_not_else = "allow"
use_self = "warn"
# Diagnostics are not actionable: Enable once https://github.com/rust-lang/rust-clippy/issues/13774 is resolved.
large_stack_arrays = "allow"
[profile.release]
strip = true
lto = "fat"
# This profile is meant to mimic the `release` profile as closely as
# possible, but using settings that are more beneficial for iterative
# development. That is, the `release` profile is intended for actually
# building the release, where as `profiling` is meant for building `uv`
# for running benchmarks.
#
# The main differences here are to avoid stripping debug information
# and disabling lto. This does result in a mismatch between our release
# configuration and our benchmarking configuration, which is unfortunate.
# But compile times with `lto = true` are completely untenable:
#
# $ cargo b --profile profiling -p uv
# Compiling uv-cli v0.0.1 (/home/andrew/astral/uv/crates/uv-cli)
# Compiling uv v0.2.34 (/home/andrew/astral/uv/crates/uv)
# Finished `profiling` profile [optimized + debuginfo] target(s) in 3m 47s
#
# Using `lto = "thin"` brings a massive improvement, but it's still slow:
#
# $ cargo b --profile profiling -p uv
# Compiling uv v0.2.34 (/home/andrew/astral/uv/crates/uv)
# Finished `profiling` profile [optimized + debuginfo] target(s) in 53.98s
#
# But with `lto = false`:
#
# $ cargo b --profile profiling -p uv
# Compiling uv v0.2.34 (/home/andrew/astral/uv/crates/uv)
# Finished `profiling` profile [optimized + debuginfo] target(s) in 30.09s
#
# We get more reasonable-ish compile times. At least, it's not enough
# time to get up and get a cup of coffee before it completes.
#
# This setup does risk that we are measuring something in benchmarks
# that we are shipping, but in order to make those two the same, we'd
# either need to make compile times way worse for development, or take
# a hit to binary size and a slight hit to runtime performance in our
# release builds.
[profile.profiling]
inherits = "release"
strip = false
debug = "full"
lto = false
# Profile for fast test execution: Skip debug info generation, and
# apply basic optimization, which speed up build and running tests.
[profile.fast-build]
inherits = "dev"
opt-level = 1
debug = 0
strip = "debuginfo"
# Profile for faster builds: Skip debug info generation, for faster
# builds of smaller binaries.
[profile.no-debug]
inherits = "dev"
debug = 0
strip = "debuginfo"
# Profile to build a minimally sized binary for uv-build
[profile.minimal-size]
inherits = "release"
opt-level = "z"
# This will still show a panic message, we only skip the unwind
panic = "abort"
codegen-units = 1
# The profile that 'cargo dist' will build with.
[profile.dist]
inherits = "release"
Reference in New Issue View Git Blame Copy Permalink