Repository navigation
Preserve local path intent when merging dependency metadata - #20631
Conversation
18e2de1 to
59cc94d
Compare
59cc94d to
152cae1
Compare
## Summary This PR does three things: * It fixes an issue where we were printing raw URLs in errors which could themselves contain credentials. * It cleans up the error messages for end users, into a form which in my opinion is cleaner and clearer. * It makes the underlying code simpler. ~~Which I need as a preparatory change for astral-sh#20631.~~ (turns out I might not need it in the end) ## Test Plan Snapshots adjusted, and a test-case for the issue has been added.
152cae1 to
b2005b7
Compare
b2005b7 to
623c076
Compare
konstin
left a comment
There was a problem hiding this comment.
I can see from the tests that this gives the correct output, but I'm trouble following why this happens. In what order are we calling with_force_relative with which values, and why this give us the desired output? Intuitively, I'd have said that we need to look at whether the pyproject.toml input paths are absolute or relative, where generated cases (workspace members) are always relative, but that doesn't seem to be the case.
623c076 to
1021c55
Compare
uv test inventory changesThis PR changes the tests when compared with the
|
efa28bf to
311d926
Compare
|
@konstin I've made some adjustments in the most recent commit and in the PR description. |
I see how this changes absolute -> relative, since METADATA URLs are absolute, but do we also change a relative input we get to an absolute one? |
Keep the output preference separate from URL identity and expose it in Debug output. The default preserves existing behaviour.
Carry local-path formatting policy from metadata loading through URL selection and output. Preserve authored source spelling while making ordinary dependency metadata portable, without changing source identity.
|
@konstin there's a possibility of that if we end up losing the original wording, but otherwise it should never happen. |
311d926 to
b0f6410
Compare
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.15` → `0.12.16` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](astral-sh/uv@0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#​21741](astral-sh/uv#21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#​21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#​21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#​21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#​21779](astral-sh/uv#21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#​21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#​21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#​21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#​21744](astral-sh/uv#21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#​21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#​21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#​20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#​21742](astral-sh/uv#21742)) - Handle malformed index URLs without panicking when credentials are configured ([#​21784](astral-sh/uv#21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#​21781](astral-sh/uv#21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#​21783](astral-sh/uv#21783)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45Ny40IiwidXBkYXRlZEluVmVyIjoiNDQuOTcuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=--> Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/46 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.15` → `0.12.16` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](astral-sh/uv@0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#​21741](astral-sh/uv#21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#​21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#​21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#​21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#​21779](astral-sh/uv#21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#​21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#​21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#​21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#​21744](astral-sh/uv#21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#​21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#​21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#​20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#​21742](astral-sh/uv#21742)) - Handle malformed index URLs without panicking when credentials are configured ([#​21784](astral-sh/uv#21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#​21781](astral-sh/uv#21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#​21783](astral-sh/uv#21783)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45Ny40IiwidXBkYXRlZEluVmVyIjoiNDQuOTcuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=--> Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/57 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.13` → `0.12.17` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](astral-sh/uv@0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#​21780](astral-sh/uv#21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#​21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#​20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#​21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#​21821](astral-sh/uv#21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#​21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#​21810](astral-sh/uv#21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#​21825](astral-sh/uv#21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#​21817](astral-sh/uv#21817)) ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](astral-sh/uv@0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#​21741](astral-sh/uv#21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#​21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#​21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#​21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#​21779](astral-sh/uv#21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#​21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#​21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#​21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#​21744](astral-sh/uv#21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#​21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#​21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#​20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#​21742](astral-sh/uv#21742)) - Handle malformed index URLs without panicking when credentials are configured ([#​21784](astral-sh/uv#21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#​21781](astral-sh/uv#21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#​21783](astral-sh/uv#21783)) ### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215) [Compare Source](astral-sh/uv@0.12.14...0.12.15) Released on 2026-09-15. This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using `uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#​21699](astral-sh/uv#21699)) ##### Performance - Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#​21675](astral-sh/uv#21675)) ##### Bug fixes - Revert "Reject symlinked wheel installation destinations" ([#​21699](astral-sh/uv#21699)) ### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214) [Compare Source](astral-sh/uv@0.12.13...0.12.14) Released on 2026-09-15. Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#​17110](astral-sh/uv#17110), [#​21599](astral-sh/uv#21599), [#​21603](astral-sh/uv#21603)) Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#​17110](astral-sh/uv#17110)) ##### Enhancements - Resume interrupted downloads with HTTP Range requests when supported ([#​21570](astral-sh/uv#21570)) - Show underlying causes and hints in user warnings ([#​21565](astral-sh/uv#21565)) - Show resolver hints for failed `uv tool upgrade` operations ([#​21566](astral-sh/uv#21566)) ##### Preview features - Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#​21618](astral-sh/uv#21618)) ##### Performance - Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#​21619](astral-sh/uv#21619)) - Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#​21593](astral-sh/uv#21593)) - Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#​21621](astral-sh/uv#21621)) ##### Bug fixes - Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#​21672](astral-sh/uv#21672)) - Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#​21625](astral-sh/uv#21625)) - Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#​21639](astral-sh/uv#21639)) - Redact credentials and signatures from missing-path-segment URL errors ([#​21616](astral-sh/uv#21616)) - Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#​21640](astral-sh/uv#21640)) - Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#​21559](astral-sh/uv#21559)) - Suppress managed-Python fallback warnings under `--quiet` ([#​21565](astral-sh/uv#21565)) - Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#​21566](astral-sh/uv#21566)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45MC4yIiwidXBkYXRlZEluVmVyIjoiNDQuMTA0LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlL2dpdGh1Yi1yZWxlYXNlIiwidHlwZS9wYXRjaCJdfQ==--> Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/632
…he manifest (astral-sh#21132) ## Summary Minor cleanup related to astral-sh#20631. ## Test Plan Existing coverage.
## Summary This PR does three things: * It fixes an issue where we were printing raw URLs in errors which could themselves contain credentials. * It cleans up the error messages for end users, into a form which in my opinion is cleaner and clearer. * It makes the underlying code simpler. ~~Which I need as a preparatory change for astral-sh#20631.~~ (turns out I might not need it in the end) ## Test Plan Snapshots adjusted, and a test-case for the issue has been added.
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Summary
Fixes #20477.
When a project and one of its dependencies refer to the same local package, the path to that local package can end up mangled by backends etc. This means we could end up losing the original spelling from pyproject.toml which we use when creating the lockfile, thus making the result an absolute path.
This PR handles merging this information properly, preferring the local metadata, so that the lockfile ends up with the right kind of path.
Broadly:
VerbatimUrlgains aforce_relativemarker, the intent being that it can be set for URLs which don't originate from sources the user can easily control and cleared for URLs that the user can override (to change relative -> absolute or vice versa).from_metadata23) is a clear source of this kind of URL and has all of its local URLs overridden. Metadata from other sources is initially left alone.from_workspaceis a mixture, so, if it's not also actually selected fromtool.uv.dependency-metadatait is set as true late inbuild_wheel_metadataand then subsequently overridden based on which package the metadata is from in:source_tree- since the metadata is coming from the user e.g. viauv pip compile pyproject.tomlManifest::with_lookaheadsfor any lookaheads which come from the current project or workspace members.ResolverOutput::add_versionfor the current project and workspace members (Manifest::with_lookaheadschanges a different copy. This duplication is potentially avoidable but would be a bigger refactor.)Urls::from_manifestmerges requirements in a specific order, to ensure that user preferences get preserved while not affecting that order, it is first merged in the normal order, withforce_relative = trueon all relevant URLs, and then any requirement which had a url withoutforce_relative = trueis merged again at the end. The merging picks the last URL so this preserves the existing editable/conflict handling.try_relative_to_iflogic when serialising, except now there's aprefers_relativerather thanwas_given_absolutewhich incorporates theforce_relativefield.Test Plan
A regression test for the original issue, and some additional coverage because the fix was broadened to avoid this class of problems in general.