An extremely fast Python package and project manager, written in Rust.
1288 matches across 14 categories. Click a row to expand file-level details.
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | Cargo.toml | 401 | # But compile times with `lto = true` are completely untenable: |
| LOW | crates/uv-auth/src/index.rs | 21 | #[serde(rename_all = "kebab-case")] |
| LOW | crates/uv-auth/src/store.rs | 61 | /// HTTP Basic Authentication |
| LOW | crates/uv-auth/src/middleware.rs | 321 | #[async_trait::async_trait] |
| LOW | crates/uv-auth/src/middleware.rs | 341 | /// - Perform the request |
| LOW | crates/uv-auth/src/realm.rs | 1 | use std::hash::{Hash, Hasher}; |
| LOW | crates/uv-keyring/tests/common/mod.rs | 1 | #![allow(dead_code)] // not all of these utilities are used by all tests |
| LOW | crates/uv-keyring/src/secret_service.rs | 101 | target: Option<String>, |
| LOW | crates/uv-keyring/src/secret_service.rs | 161 | |
| LOW | crates/uv-keyring/src/secret_service.rs | 321 | pub async fn get_all_passwords(&self) -> Result<Vec<String>> { |
| LOW | crates/uv-keyring/src/secret_service.rs | 381 | } |
| LOW | crates/uv-keyring/src/error.rs | 21 | /// without a `SemVer` break. Clients should always have default handling |
| LOW | crates/uv-keyring/src/error.rs | 41 | NoEntry, |
| LOW | crates/uv-keyring/src/lib.rs | 261 | /// |
| LOW | crates/uv-keyring/src/lib.rs | 301 | /// Set the secret for this entry. |
| LOW | crates/uv-keyring/src/lib.rs | 321 | pub async fn get_password(&self) -> Result<String> { |
| LOW | crates/uv-keyring/src/lib.rs | 341 | /// that can be set to string values. See the documentation for each credential store |
| LOW | crates/uv-keyring/src/lib.rs | 361 | /// that aren't supported by that store. |
| LOW | crates/uv-keyring/src/lib.rs | 381 | /// on some platforms, and then only if a third-party |
| LOW | crates/uv-keyring/src/credential.rs | 41 | /// |
| LOW | crates/uv-keyring/src/credential.rs | 61 | } |
| LOW | crates/uv-keyring/src/credential.rs | 81 | /// Delete the underlying credential, if there is one. |
| LOW | crates/uv-keyring/src/windows.rs | 61 | /// See the module header for the meanings of these fields. |
| LOW | crates/uv-keyring/src/windows.rs | 101 | /// The new credential replaces any existing one in the store. |
| LOW | crates/uv-requirements/src/lookahead.rs | 21 | /// The lookahead resolver resolves requirements recursively for direct URLs, so that the resolver |
| LOW | crates/uv-requirements/src/specification.rs | 1 | //! Collecting the requirements to compile, sync or install. |
| LOW | crates/uv-platform/src/libc.rs | 241 | .ok_or_else(|| LibcDetectionError::GlibcExtractionMismatch(ld_path.clone()))?; |
| LOW | crates/uv-platform/src/arch.rs | 21 | pub(crate) variant: Option<ArchVariant>, |
| LOW | crates/uv-platform/src/lib.rs | 221 | // Then architecture |
| LOW | crates/uv-platform/src/cpuinfo.rs | 21 | } |
| LOW | crates/uv-scripts/src/lib.rs | 461 | |
| LOW | crates/uv-scripts/src/lib.rs | 481 | /// print("Hello, World!") |
| LOW | crates/uv-scripts/src/lib.rs | 541 | } |
| LOW | crates/uv-scripts/src/lib.rs | 561 | // Discard any lines after the closing `# ///`. |
| LOW | crates/uv-scripts/src/lib.rs | 741 | # requires-python = '>=3.11' |
| LOW | crates/uv-scripts/src/lib.rs | 841 | let contents = indoc::indoc! {r" |
| LOW | crates/uv-distribution/src/distribution_database.rs | 41 | use crate::{Error, LocalWheel, Reporter, RequiresDist}; |
| LOW | crates/uv-distribution/src/distribution_database.rs | 561 | /// instead be enforced by the caller. |
| LOW | crates/uv-distribution/src/index/built_wheel_index.rs | 281 | /// ```text |
| LOW | crates/uv-distribution/src/metadata/lowering.rs | 281 | })? |
| LOW | …ates/uv-distribution/src/metadata/dependency_groups.rs | 21 | /// |
| LOW | crates/uv-distribution/src/metadata/requires_dist.rs | 321 | /// ```toml |
| LOW | crates/uv-distribution/src/metadata/requires_dist.rs | 341 | /// Version: 0.1.0 |
| LOW | crates/uv-pep508/src/verbatim_url.rs | 21 | /// A wrapper around [`Url`] that preserves the original string. |
| LOW | crates/uv-pep508/src/verbatim_url.rs | 481 | #[error("path could not be normalized: {0}")] |
| LOW | crates/uv-pep508/src/lib.rs | 1 | //! A library for [dependency specifiers](https://packaging.python.org/en/latest/specifications/dependency-specifiers/) |
| LOW | crates/uv-pep508/src/lib.rs | 121 | |
| LOW | crates/uv-pep508/src/lib.rs | 701 | /// |
| LOW | crates/uv-pep508/src/lib.rs | 901 | // name_req = name wsp* extras? wsp* versionspec? wsp* quoted_marker? |
| LOW | crates/uv-pep508/src/unnamed.rs | 61 | } |
| LOW | crates/uv-pep508/src/unnamed.rs | 201 | } |
| LOW | crates/uv-pep508/src/unnamed.rs | 341 | /// Like [`crate::parse_url`], but allows for extras to be present at the end of the URL, to comply |
| LOW | crates/uv-pep508/src/marker/lowering.rs | 41 | /// Critically, any variants that could be involved in a known-incompatible marker pair should |
| LOW | crates/uv-pep508/src/marker/algebra.rs | 1 | //! This module implements marker tree operations using Algebraic Decision Diagrams (ADD). |
| LOW | crates/uv-pep508/src/marker/algebra.rs | 21 | //! Specifically, a marker tree is represented as a Reduced Ordered ADD. An ADD is ordered if |
| LOW | crates/uv-pep508/src/marker/algebra.rs | 541 | } |
| LOW | crates/uv-pep508/src/marker/algebra.rs | 761 | // subtle, but since 1) edges is a disjoint covering of the |
| LOW | crates/uv-pep508/src/marker/algebra.rs | 821 | /// This method thus encodes assumptions about the environment that are not guaranteed by the |
| LOW | crates/uv-pep508/src/marker/algebra.rs | 1041 | /// Variable ordering is an interesting property of ADDs. A bad ordering |
| LOW | crates/uv-pep508/src/marker/algebra.rs | 1061 | value: ArcStr, |
| 1078 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| CRITICAL | crates/uv-client/src/httpcache/mod.rs | 685 | if self.response.headers.cc.max_age_seconds.is_some() { |
| CRITICAL | crates/uv-client/src/httpcache/mod.rs | 694 | if self.config.shared && self.response.headers.cc.s_maxage_seconds.is_some() { |
| CRITICAL | crates/uv-client/src/httpcache/mod.rs | 731 | || self.response.headers.cc.s_maxage_seconds.is_some() |
| CRITICAL | crates/uv-client/src/httpcache/mod.rs | 856 | if let Some(&max_stale) = self.request.headers.cc.max_stale_seconds.as_ref() { |
| CRITICAL | crates/uv-client/src/httpcache/mod.rs | 926 | if let Some(&s_maxage) = self.response.headers.cc.s_maxage_seconds.as_ref() { |
| CRITICAL | crates/uv-client/src/httpcache/mod.rs | 935 | if let Some(&max_age) = self.response.headers.cc.max_age_seconds.as_ref() { |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | crates/uv-python/python/packaging/__init__.py | 1 | # This file is dual licensed under the terms of the Apache License, Version |
| MEDIUM | test/requirements/transformers/pyproject.toml | 1 | # This file is a translation of |
| MEDIUM | scripts/uv-run-remote-script-test.py | 1 | # This file is used to test `uv run <url>` in ../crates/uv/tests/run.rs |
| MEDIUM | scripts/update_schemastore.py | 34 | # Create a new branch tagged with the current uv commit up to date with the latest |
| MEDIUM | scripts/check_embedded_python.py | 23 | # Create a temporary directory. |
| MEDIUM | scripts/check_embedded_python.py | 25 | # Create a virtual environment with `uv`. |
| MEDIUM | scripts/check_cache_compat.py | 122 | # Create a temporary directory. |
| MEDIUM | scripts/check_system_python.py | 134 | # Create a temporary directory. |
| MEDIUM | scripts/check_system_python.py | 189 | # Create a virtual environment with `uv`. |
| MEDIUM | scripts/benchmark/src/benchmark/resolver.py | 356 | # Create a Poetry project. |
| MEDIUM | scripts/benchmark/src/benchmark/resolver.py | 640 | # Create a PDM project. |
| MEDIUM | scripts/benchmark/src/benchmark/resolver.py | 1037 | # Create a Poetry project. |
| MEDIUM | scripts/smoke-test/commands.sh | 10 | # Create a virtual environment and install a package with `uv pip` |
| MEDIUM | .github/workflows/release.yml | 303 | # Create a GitHub Release while uploading all files to it |
| MEDIUM | .github/workflows/release.yml | 329 | # Create a GitHub Release while uploading all files to it |
| MEDIUM | .github/workflows/build-docker.yml | 283 | # Initialize a variable to store all tag docker metadata patterns |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | crates/uv-build/python/uv_build/__init__.py | 21 | |
| LOW | crates/uv-build/python/uv_build/__init__.py | 21 | |
| LOW | crates/uv-build/python/uv_build/__init__.py | 22 | |
| LOW | crates/uv-virtualenv/src/activator/activate_this.py | 31 | |
| LOW | crates/uv-python/python/get_interpreter_info.py | 654 | |
| LOW | crates/uv-python/python/packaging/_manylinux.py | 8 | |
| LOW | …ed/excluded/bird-feeder/check_installed_bird_feeder.py | 1 | |
| LOW | …ed/excluded/bird-feeder/check_installed_bird_feeder.py | 4 | |
| LOW | …luded/excluded/bird-feeder/src/bird_feeder/__init__.py | 1 | |
| LOW | …oject-in-excluded/packages/seeds/src/seeds/__init__.py | 1 | |
| LOW | …lbatross-project-in-excluded/src/albatross/__init__.py | 1 | |
| LOW | …ce/packages/bird-feeder/check_installed_bird_feeder.py | 1 | |
| LOW | …ce/packages/bird-feeder/check_installed_bird_feeder.py | 4 | |
| LOW | …space/packages/bird-feeder/src/bird_feeder/__init__.py | 1 | |
| LOW | …ss-root-workspace/packages/seeds/src/seeds/__init__.py | 1 | |
| LOW | …ces/albatross-root-workspace/src/albatross/__init__.py | 1 | |
| LOW | …ce/packages/bird-feeder/check_installed_bird_feeder.py | 1 | |
| LOW | …ce/packages/bird-feeder/check_installed_bird_feeder.py | 4 | |
| LOW | …space/packages/bird-feeder/src/bird_feeder/__init__.py | 1 | |
| LOW | …virtual-workspace/packages/seeds/src/seeds/__init__.py | 1 | |
| LOW | …workspace/packages/albatross/src/albatross/__init__.py | 1 | |
| LOW | …aces/albatross-in-example/check_installed_albatross.py | 4 | |
| LOW | …le/examples/bird-feeder/check_installed_bird_feeder.py | 1 | |
| LOW | …le/examples/bird-feeder/check_installed_bird_feeder.py | 4 | |
| LOW | …ample/examples/bird-feeder/src/bird_feeder/__init__.py | 1 | |
| LOW | …kspaces/albatross-in-example/src/albatross/__init__.py | 1 | |
| LOW | …deptry_reproducer/python/deptry_reproducer/__init__.py | 1 | |
| LOW | …ges/built-by-uv/src/built_by_uv/arithmetic/__init__.py | 1 | |
| LOW | python/uv/_find_uv.py | 1 | |
| LOW | python/uv/__init__.py | 1 | |
| LOW | python/uv/__init__.py | 3 | |
| LOW | scripts/publish-crates.py | 12 | |
| LOW | scripts/update_schemastore.py | 8 | |
| LOW | scripts/sync-python-version-constants.py | 19 | |
| LOW | scripts/check_cache_compat.py | 7 | |
| LOW | scripts/vendor-packaging.py | 16 | |
| LOW | scripts/check_system_python.py | 126 | |
| LOW | scripts/generate-known-stdlib.py | 8 | |
| LOW | scripts/transform_readme.py | 8 | |
| LOW | scripts/patch-dist-manifest-checksums.py | 10 | |
| LOW | scripts/check-trampoline-version-consistency.py | 12 | |
| LOW | scripts/setup-crates-io-publish.py | 25 |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | crates/uv-types/src/traits.rs | 68 | /// ┌────────────────┐ |
| MEDIUM | crates/uv-types/src/traits.rs | 70 | /// └───────▲────────┘ |
| MEDIUM | crates/uv-types/src/traits.rs | 73 | /// ┌───────┴────────┐ |
| MEDIUM | crates/uv-types/src/traits.rs | 74 | /// ┌─────────►│ uv-dispatch │◄─────────┐ |
| MEDIUM | crates/uv-types/src/traits.rs | 75 | /// │ └───────▲────────┘ │ |
| MEDIUM | crates/uv-types/src/traits.rs | 78 | /// ┌───────┴────────┐ ┌───────┴────────┐ ┌────────┴────────────────┐ |
| MEDIUM | crates/uv-types/src/traits.rs | 80 | /// └───────▲────────┘ └───────▲────────┘ └────────▲────────────────┘ |
| MEDIUM | crates/uv-types/src/traits.rs | 82 | /// └─────────────┐ │ ┌──────────────┘ |
| MEDIUM | crates/uv-types/src/traits.rs | 85 | /// └────────────────┘ |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | crates/uv-distribution-types/src/any.rs | 75 | /// Like [`InstalledVersion`], but with [`CanonicalUrl`] to ensure robust URL comparisons. |
| MEDIUM | crates/uv-client/src/httpcache/mod.rs | 254 | /// whether a new request can utilize a cached response or not. This is |
| MEDIUM | crates/uv-extract/src/stream.rs | 520 | // that leverage this feature anyway. |
| MEDIUM | crates/uv-windows/src/exception.rs | 37 | /// halfway through a Rust operation. It needs to be robust to operating with unknown program |
| MEDIUM | crates/uv/tests/it/init.rs | 1937 | // robust to errors in discovery. |
| MEDIUM | crates/uv-trampoline/src/bounce.rs | 198 | /// PEP 405 specifies a more robust procedure (checking both the parent and grandparent |
| MEDIUM | crates/uv-trampoline/src/bounce.rs | 434 | // See also <https://github.com/astral-sh/uv/pull/18170> which explores a more robust solution |
| MEDIUM | crates/uv-build-frontend/src/lib.rs | 741 | // allow us to leverage the hook in _most_ cases while still avoiding incorrect metadata for |
| MEDIUM | crates/uv-python/src/environment.rs | 329 | // should be generally robust. |
| MEDIUM | crates/uv-python/src/interpreter.rs | 156 | /// This routine mimics the CPython `getpath.py` logic in order to make a more robust assessment |
| LOW | python/uv/__main__.py | 12 | # If it's already set, then just use it |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | crates/uv-build/python/uv_build/__init__.py | 92 | def get_requires_for_build_sdist( |
| LOW | crates/uv-build/python/uv_build/__init__.py | 100 | def get_requires_for_build_wheel( |
| LOW | crates/uv-build/python/uv_build/__init__.py | 108 | def prepare_metadata_for_build_wheel( |
| LOW | crates/uv-build/python/uv_build/__init__.py | 128 | def get_requires_for_build_editable( |
| LOW | crates/uv-build/python/uv_build/__init__.py | 136 | def prepare_metadata_for_build_editable( |
| LOW | crates/uv/tests/it/sync.rs | 6153 | def prepare_metadata_for_build_editable(metadata_directory, config_settings=None): |
| LOW | crates/uv-python/python/get_interpreter_info.py | 110 | def _running_under_legacy_virtualenv() -> bool: |
| LOW | crates/uv-python/python/get_interpreter_info.py | 283 | def _should_use_osx_framework_prefix() -> bool: |
| LOW | crates/uv-python/python/get_interpreter_info.py | 420 | def get_operating_system_and_architecture(): |
| LOW | crates/uv-python/python/packaging/_manylinux.py | 83 | def _glibc_version_string_confstr() -> "str | None": |
| LOW | crates/uv-python/python/packaging/_manylinux.py | 102 | def _glibc_version_string_ctypes() -> "str | None": |
| LOW | scripts/publish-crates.py | 110 | def build_cargo_publish_command( |
| LOW | scripts/create-python-mirror.py | 65 | def collect_metadata_from_git_history() -> List[Dict]: |
| LOW | scripts/check-trampoline-version-consistency.py | 21 | def get_locked_windows_version(lockfile_path: Path) -> str | None: |
| LOW | scripts/setup-crates-io-publish.py | 114 | def load_workspace_package_metadata() -> dict[str, object]: |
| LOW | scripts/setup-crates-io-publish.py | 123 | def publish_placeholder_crate( |
| LOW | scripts/setup-crates-io-publish.py | 248 | def handle_trusted_publisher_error(exc: httpx.HTTPStatusError) -> None: |
| LOW | scripts/publish/test_publish.py | 287 | def check_index_for_provenance( |
| LOW | scripts/publish/test_publish.py | 562 | def test_reupload_with_check_url( |
| LOW | scripts/publish/test_publish.py | 630 | def test_reupload_modified_files( |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | crates/uv-publish/src/lib.rs | 750 | // Step 1: Reserve an upload slot. |
| LOW | crates/uv-publish/src/lib.rs | 805 | // Step 2: Upload the file directly to S3 (if needed). |
| LOW | crates/uv-publish/src/lib.rs | 909 | // Step 3: Finalize the upload. |
| LOW | crates/uv/tests/it/pip_install.rs | 15104 | // Step 1: Install as editable first. |
| LOW | crates/uv/tests/it/pip_install.rs | 15120 | // Step 2: Use `--no-sources`; we should retain the package. |
| LOW | crates/uv/tests/it/sync.rs | 16664 | // Step 1: `uv sync --no-sources` should install `anyio` from PyPI. |
| LOW | crates/uv/tests/it/sync.rs | 16680 | // Step 2: `uv sync` should switch to an editable installation. |
| LOW | crates/uv/tests/it/sync.rs | 16697 | // Step 3: `uv sync --no-sources` again should switch back to PyPI package. |
| LOW | crates/uv/src/commands/pip/tree.rs | 239 | // Step 1: Add each installed package. |
| LOW | crates/uv/src/commands/pip/tree.rs | 253 | // Step 2: Add all dependencies. |
| LOW | crates/uv/src/commands/pip/tree.rs | 287 | // Step 2: Reverse the graph. |
| LOW | crates/uv/src/commands/pip/tree.rs | 292 | // Step 3: Filter the graph to those nodes reachable from the target packages. |
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | dist-workspace.toml | 57 | # Whether CI should include auto-generated code to build local artifacts |
| HIGH | crates/uv-types/src/requirements.rs | 32 | /// A set of requirements as requested by a parent requirement. |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | scripts/publish-crates.py | 8 | # Usage: |
| LOW | scripts/install-cargo-extensions.sh | 8 | ## Usage: |
| LOW | scripts/check-release-artifact-sboms.sh | 7 | ## Usage: |
| LOW | scripts/codesign-macos.sh | 5 | # Usage: |
| LOW | scripts/nextest-setup-hook-unix.sh | 7 | # Usage: |
| LOW | scripts/apply-ci-snapshots.sh | 4 | # Usage: |
| LOW | scripts/cargo.sh | 6 | ## Usage: |
| LOW | scripts/sync_scenarios.sh | 5 | # Usage: |
| LOW | scripts/setup-crates-io-publish.py | 16 | # Usage: |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | crates/uv-virtualenv/src/_virtualenv.py | 50 | |
| LOW | crates/uv-python/fetch-download-metadata.py | 218 | |
| LOW | crates/uv-python/fetch-download-metadata.py | 572 | |
| LOW | crates/uv-python/fetch-download-metadata.py | 678 | |
| LOW | crates/uv-python/python/get_interpreter_info.py | 420 | |
| LOW | crates/uv-python/python/packaging/_manylinux.py | 214 | |
| LOW | scripts/registries-test.py | 69 | |
| LOW | scripts/registries-test.py | 170 | |
| LOW | scripts/setup-crates-io-publish.py | 276 | |
| LOW | scripts/publish/test_publish.py | 717 |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | crates/uv/tests/it/run.rs | 4494 | print(f"Error: Expected pythonw.exe but got: {executable}", file=sys.stderr) |
| LOW | scripts/registries-test.py | 257 | except Exception as e: |
| LOW | scripts/registries-test.py | 339 | except Exception as e: |
| MEDIUM | scripts/repair-sdist-cargo-lock.py | 26 | print(f"Error: {sdist_path} is not a valid tar file", file=sys.stderr) |
| LOW | scripts/create-python-mirror.py | 87 | except Exception as e: |
| LOW | scripts/create-python-mirror.py | 183 | except Exception as e: |
| LOW | scripts/create-python-mirror.py | 287 | except Exception as e: |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | scripts/update_schemastore.py | 70 | # Check if the schema has changed |
| LOW | scripts/nextest-setup-hook-unix.sh | 18 | # Set UV_TEST_CODESIGN_IDENTITY to enable signing. See `scripts/codesign-macos.sh`. |
| LOW | scripts/apply-ci-snapshots.sh | 83 | # Check if any artifacts were downloaded |
| LOW | scripts/generate-crate-readmes.py | 123 | # Check if README already exists |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | crates/uv/tests/it/build_backend.rs | 1258 | {name = "Jane Doe", email = "jane@example.com"}, |
| LOW | crates/uv/tests/it/build_backend.rs | 1259 | {name = "John Doe"}, |