Comparing changes

## Summary This PR moves Windows release builds to the 16-core Namespace profile that we already use in Windows tests. For ARM, we cross-compile (and run its wheel smoke tests in a separate native job). Windows x64 was the slowest job in the [uv 0.12.8 release](https://github.com/astral-sh/uv/actions/runs/33440288847/job/99646850772): 58m40s, including 40m12s for the PGO build/training step and 14m02s for the final uv wheel build. For ARM64, the first comparison at the same Rust source revision (`68209e5c6`) reduced the combined wheel-build time by 55%: | Wheel build | [GitHub native ARM64, 8 vCPUs](https://github.com/astral-sh/uv/actions/runs/33440288847/job/99646850768) | [Namespace x64 cross-build, 16 vCPUs](https://github.com/astral-sh/uv/actions/runs/33450410999/job/99678939550) | | ----------- | -------------------------------------------------------------------------------------------------------: | --------------------------------------------------------------------------------------------------------------: | | uv | 26m24s | 11m47s | | uv-build | 2m07s | 58s | | Total | 28m31s | 12m45s | These are wheel-build step timings, excluding runner queueing and native smoke tests. The comparison includes the hardware change and uses one run per configuration.

Retry diagnostics format raw response URLs and nested request errors, bypassing URL redaction and exposing signed query parameters. Redact those URLs in response, error, and cause-chain diagnostics, including errors wrapped by the retry middleware. Keep the original errors and retry decisions unchanged. Co-authored-by: Zanie Blue <contact@zanie.dev>

Redirects currently compare hosts and effective ports when deciding whether to retain sensitive headers. A scheme change on the same port therefore retains headers across authentication realms. Use `RealmRef` for this decision so redirect handling follows the same scheme, host, and port boundary as `uv-auth`. Co-authored-by: Zanie Blue <contact@zanie.dev>

`UV_LOCKED=1 uv sync --frozen` fails because the CLI flag and environment variable are resolved independently and then treated as conflicting. Give explicit `--locked` and `--frozen` flags precedence across project commands, warning when the conflicting environment value is ignored. Apply the same precedence to `uv lock --check` and `--check-exists`, so `UV_FROZEN` cannot silently skip an explicitly requested freshness check. Conflicting modes from the same source remain errors. --------- Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com> Co-authored-by: Zsolt Dollenstein <zsol.zsol@gmail.com> Co-authored-by: Zanie Blue <contact@zanie.dev>

Concurrent uv processes sharing a cache could each extract the same local wheel or a wheel built from a source distribution. Source builds were serialized, but their lock was released before extracting the result, and the extraction locks were enabled only on Windows. Acquire the lock for the source-specific wheel cache entry on every platform before checking for an extracted wheel, and hold it through publication. For built wheels, this remains scoped to the source revision and build settings, allowing waiting processes to reuse the completed extraction. Keep the existing Windows lock names for shared-cache compatibility and use bounded wheel cache keys elsewhere. Co-authored-by: Zanie Blue <contact@zanie.dev>

A terminal dependency cycle disappears from both text and JSON output when `uv tree --invert` cannot find a package without incoming edges. Capture the empty pure-cycle case and the mixed case where an ordinary leaf masks a missing cycle, while preserving explicit `--package` selection. Reproduces #19972. Co-authored-by: Zanie Blue <contact@zanie.dev>

When passed `--check-exists`, `uv lock` reports that `--frozen` was provided because parsing discards which spelling was used. Preserve CLI flag identity within the source for both locked and frozen modes, and resolve that source once before applying precedence. Carry the resolved source through environment override warnings, lockfile freshness warnings, and errors for missing lockfiles or workspace members. The existing locking behavior and argument conflicts are preserved. --------- Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

## Summary This version of async_http_range_reader fixes a memory un-safety bug which can be triggered when trying to range-request metadata out of a malicious wheel or from a malicious wheel host. I have not been able to rule out that we're affected, but I have also not been able to get us to trigger it. The difficulty is mainly down to us using a single threaded executor. ## Test Plan Test suite.

With `UV_LOCKED=1` or `UV_FROZEN=1` set globally, creating or updating a lockfile can require changing the environment. Add `--no-locked` and `--no-frozen` so a single invocation can disable either mode. Each negation affects only its own mode and follows the existing last-argument-wins convention, including the `--check` and `--check-exists` spellings accepted by `uv lock`. Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

`LockedSource` and `FrozenSource` include workspace configuration cases even though neither mode supports configuration values. Remove those unreachable variants and resolve the CLI and environment sources directly. This also removes the unused configuration branches from lockfile diagnostics, with no change to flag precedence or lockfile behavior. Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

Automated update for Python releases. Co-authored-by: astral-automations-bot[bot] <305554984+astral-automations-bot[bot]@users.noreply.github.com>

The shallow checkout introduced in #21291 can leave the PR event's base commit unavailable when the checked-out merge ref has advanced. For example, [this plan job](https://github.com/astral-sh/uv/actions/runs/32879928850/job/97908302255) logged `Invalid symmetric difference expression` but reported success, causing tests and builds to be skipped. Revert #21291 and restore `fetch-depth: 0` so the planner has the history needed to resolve the comparison base.

Automated update for Python releases. Co-authored-by: astral-automations-bot[bot] <305554984+astral-automations-bot[bot]@users.noreply.github.com>

## Summary We now extract streaming ZIP archives in one blocking task per archive, fed through a bounded 256 KiB buffer. This avoids scheduling each filesystem operation separately while letting reading and extraction overlap. We also reuse the copy buffer across files instead of allocating a new one for every file. The shared implementation handles wheels, source ZIPs, Python and binary ZIP downloads, and `uv-dev validate-zip`. The worker owns the temporary directory; cancellation closes the pipe, and cleanup happens when the worker exits. Process shutdown can leave temporary cache entries behind. The measurements below cover wheel installs. ### HTTP wheels For cold installs, compared with main: | Package | Baseline | This PR | Change | | ----------- | -------: | -------: | -----: | | Jupyter | 2,181 ms | 719 ms | -67% | | AnyIO | 106 ms | 98 ms | -8% | | SymPy | 831 ms | 412 ms | -50% | | NumPy | 582 ms | 381 ms | -35% | | PyTorch CPU | 6,032 ms | 3,291 ms | -45% | Warm-cache installs showed no clear change. Peak memory increased: Jupyter went from 70 to 103 MiB. ### Local wheels With `--require-hashes`, compared with the previous PR implementation: | Package | Baseline | This PR | Change | | ------------------ | -------: | -------: | -----: | | Jupyter, 93 wheels | 1,639 ms | 726 ms | -55.7% | | AnyIO | 97 ms | 91 ms | -5.8% | | SymPy | 714 ms | 387 ms | -45.8% | | NumPy | 541 ms | 369 ms | -31.8% | | PyTorch CPU | 5,395 ms | 3,410 ms | -36.8% | With content-addressed caching enabled, time reductions were similar: 5 to 56%. Every cold-install 95% interval favored the updated implementation. Peak RSS increased by 27–33 MiB for Jupyter and 4–5 MiB for PyTorch. Warm-cache installs and unchanged seekable-path controls showed no clear change, though small differences remain unresolved. --------- Co-authored-by: konsti <konsti@openai.com>

## Summary Stacked on #21372. We now create wheel extraction directories through `WheelExtractor`. Both streaming and seekable extraction consume it and return an `ExtractedWheel` that owns the directory and file metadata through `RECORD` validation and cache persistence. This removes the separate `TempDir` transfers from callers and keeps the seekable worker's directory alive until extraction finishes. Implements the ownership refactor suggested in #21372 (comment).

Signed-off-by: William Woodruff <william@yossarian.net>

Co-authored-by: astral-automations-bot[bot] <305554984+astral-automations-bot[bot]@users.noreply.github.com> Co-authored-by: Zanie Blue <contact@zanie.dev>

Navigation Menu

Repository navigation

Comparing changes

Open a pull request

Commits on Sep 1, 2026

This comparison is taking too long to generate.

Uh oh!