Accepting request 1303630 from devel:languages:python

- update to 0.8.16
 * Enhancements
  * Allow --editable to override editable = false annotations 
  * Allow editable = false for workspace sources 
  * Show a dedicated error for virtual environments in source trees on build 
  * Support Android platform tags 
  * Support iOS platform tags 
  * Support scripts with inline metadata in --with-requirements and --requirements 
 * Preview features
  * Support --no-project in uv format 
  * Allow uv format in unmanaged projects 
 * Bug fixes
  * Avoid erroring when match-runtime target is optional 
  * Ban empty usernames and passwords in uv auth 
  * Error early for parent path in build backend 
  * Retry on IO errors during HTTP/2 streaming 
  * Support recursive requirements and constraints inclusion 
  * Use token store credentials for uv publish 
  * Fix virtual environment activation script compatibility with latest nushell 
  * Skip Python interpreters that cannot be queried with permission errors 
 * Documentation
  * Clarify that uv auth commands take a URL 
  * Improve the CLI help for options that accept requirements files 
  * Adds example for caching for managed Python downloads in Docker builds

OBS-URL: https://build.opensuse.org/request/show/1303630
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=48

python-uv-0.8.16.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6a2074c2e146a3f3085ae52ff5c6c24545d8f95e15764569144aa13bd95d5421
+size 4441379

python-uv.changes

@@ -1,8 +1,385 @@
 -------------------------------------------------------------------
-Mon Aug 11 09:19:24 UTC 2025 - Nico Krapp <nico.krapp@suse.com>
+Wed Sep 10 11:03:40 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
 
-- Add CVE-2025-54368.patch to fix CVE-2025-54368 (bsc#1247829)
-- bump vendored dependency slab to 0.4.11 to fix CVE-2025-55159 (bsc#1248005)
+- update to 0.8.16
+ * Enhancements
+  * Allow --editable to override editable = false annotations 
+  * Allow editable = false for workspace sources 
+  * Show a dedicated error for virtual environments in source trees on build 
+  * Support Android platform tags 
+  * Support iOS platform tags 
+  * Support scripts with inline metadata in --with-requirements and --requirements 
+ * Preview features
+  * Support --no-project in uv format 
+  * Allow uv format in unmanaged projects 
+ * Bug fixes
+  * Avoid erroring when match-runtime target is optional 
+  * Ban empty usernames and passwords in uv auth 
+  * Error early for parent path in build backend 
+  * Retry on IO errors during HTTP/2 streaming 
+  * Support recursive requirements and constraints inclusion 
+  * Use token store credentials for uv publish 
+  * Fix virtual environment activation script compatibility with latest nushell 
+  * Skip Python interpreters that cannot be queried with permission errors 
+ * Documentation
+  * Clarify that uv auth commands take a URL 
+  * Improve the CLI help for options that accept requirements files 
+  * Adds example for caching for managed Python downloads in Docker builds 
+
+-------------------------------------------------------------------
+Thu Sep  4 11:03:52 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.15
+ * Enhancements
+  * Add uv auth commands for credential management 
+  * Add pyx support to uv auth commands 
+  * Add uv tree --show-sizes to show package sizes 
+  * Add --python-platform riscv64-unknown-linux 
+  * Add --python-platform to uv run and uv tool 
+  * Add uv publish --dry-run 
+  * Add zstandard support for wheels 
+  * Allow registries to pre-provide core metadata 
+  * Retry streaming Python and binary download errors 
+ * Bug fixes
+  * Fix settings rendering for extra-build-dependencies 
+  * Skip non-existent directories in bytecode compilation 
+ * Error messages
+  * Add error trace to invalid package format 
+
+-------------------------------------------------------------------
+Tue Sep  2 14:56:39 UTC 2025 - Nico Krapp <nico.krapp@suse.com>
+
+- Update vendor tarball to fix CVE-2025-58160 (bsc#1249011) 
+
+-------------------------------------------------------------------
+Thu Aug 28 22:10:39 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.14
+ * Enhancements
+  * Add --python-platform to uv pip check 
+  * Add an environment variable for UV_ISOLATED 
+  * Add logging to the uv build backend 
+  * Allow more trailing null bytes in zip files 
+  * Allow pinning managed Python versions to specific build versions 
+  * Cache PyTorch wheels by default 
+  * Reject already-installed wheels that don't match the target platform 
+  * Add --no-install-local option to uv sync, uv add and uv export 
+  * Include cycle error message in uv pip CLI 
+ * Preview features
+  * Fix format of {version} on uv format failure 
+  * Lock during installs in uv format to prevent races 
+  * Respect --project in uv format 
+  * Run uv format in the project root 
+ * Configuration
+  * Add file-to-CLI overrides for build isolation configuration 
+  * Add file-to-CLI overrides for reinstall configuration 
+ * Performance
+  * Cache WHEEL and METADATA reads in installed distributions 
+ * Bug fixes
+  * Avoid erroring when creating venv in current working directory 
+  * Avoid introducing unnecessary system dependency on CUDA 
+  * Clear discovered site packages when creating virtual environment 
+  * Read index credentials from the environment during uv publish checks 
+  * Refuse to remove non-virtual environments in uv venv 
+  * Stop setting CLICOLOR_FORCE=1 when calling build backends 
+  * Support file or directory removal for Windows symlinks 
+ * Documentation
+  * Fix GitHub guide highlight lines 
+  * Move Resolver to new Internals section in the Reference 
+  * Split the "Authentication" page into sections 
+  * Update uninstall docs to mention uvw.exe needs to be removed 
+
+-------------------------------------------------------------------
+Fri Aug 22 13:54:55 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.13
+ * Enhancements
+  * Add --no-install-* arguments to uv add 
+  * Initialize Git prior to reading author in uv init 
+  * Add CUDA 129 to available torch backends 
+  * Update Pyodide to 0.28.2 
+ * Preview features
+  * Add an experimental uv format command 
+  * Allow version specifiers in extra-build-dependencies if match-runtime is explicitly false 
+ * Bug fixes
+  * Add triton to torch-backend manifest 
+  * Avoid panicking when resolver returns stale distributions 
+  * Fix uv_build wheel hashes 
+  * Treat --upgrade-package on the command-line as overriding upgrade = false in configuration 
+
+-------------------------------------------------------------------
+Wed Aug 20 09:03:55 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.12
+ * Enhancements
+  * Add an aarch64-pc-windows-msvc target for python-platform 
+  * Add fallback parent process detection to uv tool update-shell 
+  * Install non-build-isolation packages in a second phase 
+  * Add hint when virtual environments are included in source distributions 
+  * Add Docker images derived from buildpack-deps:trixie, debian:trixie-slim, alpine:3.22 
+ * Bug fixes
+  * Reject already-installed wheels built with outdated settings 
+  * Skip interpreters that are not found on query 
+  * Handle dotted package names in script path resolution 
+  * Reject match-runtime = true for dynamic packages 
+ * Documentation
+  * Document improvements to build-isolation setups 
+  * Fix reference documentation recommendation to use uv cache clean instead of clear 
+
+-------------------------------------------------------------------
+Fri Aug 15 17:37:36 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.11
+ * Enhancements
+  * Add extra-build-dependencies hint for any missing module on build failure 
+  * Make 'v' prefix cyan in overlap warnings 
+ * Bug fixes
+  * Fix missing uv version in extended Docker image tags 
+  * Persist cache info when re-installing cached wheels 
+ * Rust API
+  *Allow passing custom reqwest clients to RegistryClient
+
+-------------------------------------------------------------------
+Thu Aug 14 09:13:47 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.10 
+ * Enhancements
+  * Allow Python requests with missing segments, e.g., just aarch64 
+ * Preview
+  * Move warnings for conflicting modules into preview 
+
+-------------------------------------------------------------------
+Tue Aug 12 09:30:49 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.9
+ * Enhancements
+  * Add --reinstall flag to uv python upgrade 
+ * Bug fixes
+  * Include build settings in cache key for registry source distribution lookups 
+  * Avoid creating bin links on uv python upgrade if they don't already exist 
+  * Respect system proxies on macOS and Windows 
+ * Documentation
+  * Add the 3.14 classifier 
+
+-------------------------------------------------------------------
+Sat Aug  9 10:32:25 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.8
+ - long changelog at https://github.com/astral-sh/uv/blob/main/CHANGELOG.mode
+ - fixed CVE-2025-54368 - boo#1247829 
+
+-------------------------------------------------------------------
+Wed Aug  6 12:36:01 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.5
+ * Enhancements
+  * Enable uv run with a GitHub Gist 
+  * Improve HTTP response caching log messages 
+  * Show wheel tag hints in install plan 
+  * Support installing additional executables in uv tool install 
+ * Preview features
+  * Enable extra build dependencies to 'match runtime' versions 
+  * Remove duplicate extra-build-dependencies warnings for uv pip 
+  * Use "option" instead of "setting" in pylock warning 
+  * Respect extra build requires when reading from wheel cache 
+  * Preserve lowered extra build dependencies 
+ * Bug fixes
+  * Add Python versions to markers implied from wheels 
+  * Ensure consistent indentation when adding dependencies 
+  * Fix handling of python-preference = system when managed interpreters are on the PATH 
+  * Fix symlink preservation in virtual environment creation 
+  * Gracefully handle entrypoint permission errors 
+  * Include wheel hashes from local Simple indexes 
+  * Prefer system Python installations over managed ones when --system is used 
+  * Remove retry wrapper when matching on error kind 
+  * Revert h2 upgrade 
+ * Documentation
+  * Improve visibility of copy and line separator in dark mode 
+
+-------------------------------------------------------------------
+Thu Jul 31 15:49:55 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.4
+ * Enhancements
+  * Improve styling of warning cause chains 
+  * Extend wheel filtering to Android tags 
+  * Perform wheel lockfile filtering based on platform and OS intersection 
+  * Clarify messaging when a new resolution needs to be performed 
+ * Preview features
+  * Add support for extending package's build dependencies with extra-build-dependencies 
+  * Split preview mode into separate feature flags 
+ * Configuration
+  * Add support for package specific exclude-newer dates via exclude-newer-package 
+ * Bug fixes
+  * Avoid invalidating lockfile when path or workspace dependencies define explicit indexes 
+  * Copy entrypoints that have a shebang that differs in python vs python3 
+  * Fix incorrect file permissions in wheel packages 
+  * Update validation for environments and required-environments in uv.toml 
+ * Documentation
+  * Show uv_build in projects documentation 
+  * Add UV_ prefix to installer environment variables 
+  * Un-hide uv from --build-backend options 
+  * Update documentation for preview flags 
+
+-------------------------------------------------------------------
+Sun Jul 27 20:33:23 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.3:
+ * Enhancements
+  * Allow non-standard entrypoint names in uv_build 
+  * Publish riscv64 wheels to PyPI 
+ * Bug fixes
+  * Avoid writing redacted credentials to tool receipt 
+  * Respect --with versions over base environment versions 
+  * Respect credentials from all defined indexes 
+  * Fix missed stabilization of removal of registry entry during Python uninstall 
+  * Improve concurrency safety of Python downloads into cache 
+ * Documentation
+  * Fix typos in uv_build reference documentation 
+  * Move the "Cargo" install method further down in docs 
+
+-------------------------------------------------------------------
+Wed Jul 23 17:58:13 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.2
+
+ * Configuration
+   * Add UV_INIT_BUILD_BACKEND 
+ * Rust API
+   * Expose tls_built_in_root_certs for client 
+ * Enhancements
+   * Add derivation chains for dependency errors 
+   * Add support for HF_TOKEN 
+   * Allow --config-settings-package to apply configuration settings at the package level 
+   * Create (e.g.) python3.13t executables in uv venv 
+   * Disallow writing symlinks outside the source distribution target directory 
+   * Elide traceback when python -m uv in interrupted with Ctrl-C on Windows 
+   * Match --bounds formatting for uv_build bounds in uv init 
+   * Support extras and dependency_groups markers in PEP 508 grammar 
+   * Support extras and dependency_groups markers on uv pip install and uv pip sync 
+   * Add hint to use uv self version when uv version cannot find a project 
+   * Improve error reporting when removing Python versions from the Windows registry 
+   * Make warnings about masked [tool.uv] fields more precise 
+ * Preview features
+   * Emit JSON output in uv sync with --quiet 
+ * Bug fixes
+   * Avoid reading files in the environment bin that are not entrypoints 
+   * Avoid removing empty directories when constructing virtual environments 
+   * Preserve index URL priority order when writing to pyproject.toml 
+   * Allow removal of virtual environments with missing interpreters 
+   * Apply Cache-Control overrides to response, not request headers 
+   * Copy entry points into ephemeral environments to ensure layers are respected 
+   * Workaround Jupyter Lab application directory discovery in ephemeral environments 
+   * Enforce requires-python in pylock.toml 
+   * Fix kebab casing of README variants in build backend 
+   * Improve concurrency resilience of removing Python versions from the Windows registry 
+   * Retry HTTP requests on invalid data errors 
+   * Update virtual environment removal to delete pyvenv.cfg last 
+   * Error on unknown fields in dependency-metadata 
+
+-------------------------------------------------------------------
+Fri Jul 18 18:14:03 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.0
+ * Breaking changes
+   * Install Python executables into a directory on the PATH
+   * Prompt before removing an existing directory in uv venv
+   * Validate that discovered interpreters meet the Python preferences
+   * Install dependencies without build systems when they are path sources
+   * Install dependencies without build systems when they are workspace members
+   * Bump --python-platform linux to manylinux_2_28
+   * Remove uv version fallback
+   * Require --global for removal of the global Python pin
+   * Support conflicting editable settings across groups
+   * Make uv_build the default build backend in uv init
+   * Set default UV_TOOL_BIN_DIR on Docker images
+   * Update --check to return an exit code of 1
+   * Use an ephemeral environment for uv run --with invocations
+   * Restructure the uv venv command output and exit codes
+   * Default to --workspace when adding subdirectories
+   * Add missing validations for disallowed uv.toml fields
+ * Configuration
+   * Add support for toggling Python bin and registry install options via env vars 
+   * Add UV_COMPILE_BYTECODE_TIMEOUT environment variable 
+   * Allow users to override index cache-control headers 
+   * Add UV_LIBC to override libc selection in multi-libc environment 
+ * Bug fixes
+   * Fix --all-arches when paired with --only-downloads 
+   * Skip Windows Python interpreters that return a broken MSIX package code 
+   * Warn on invalid uv.toml when provided via direct path 
+   * Improve async signal safety in Windows exception handler 
+ * Documentation
+   * Mention the revision in the lockfile versioning doc 
+   * Move "Conflicting dependencies" to the "Resolution" page 
+   * Rename "Dependency specifiers" section to exclude PEP 508 reference 
+   * Suggest uv cache clean prior to --reinstall 
+ * Preview features
+   * Make preview Python registration on Windows non-fatal 
+   * Update preview installation of Python executables to be non-fatal 
+   * Add uv python update-shell 
+
+-------------------------------------------------------------------
+Tue Jul 15 08:11:49 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.7.21
+ * Enhancements
+   * Add --python-platform to uv sync 
+   * Support pre-releases in uv version --bump 
+   * Add -w shorthand for --with 
+   * Add an exception handler on Windows to display information on crash 
+   * Add hint when Python downloads are disabled 
+   * Add UV_HTTP_RETRIES to customize retry counts 
+   * Follow leaf symlinks matched by globs in cache-key 
+   * Support parent path components (..) in globs in cache-key 
+   * Improve cache-key performance 
+ * Preview features
+   * Add uv sync --output-format json 
+ * Bug fixes
+   * Do not re-resolve with a new Python version in uv tool if it is incompatible with --python 
+ * Documentation
+   * Document how to nest dependency groups with include-group 
+   * Fix repeated word in Pyodide doc 
+   * Update CONTRIBUTING.md with instructions to format Markdown files via Docker 
+   * Fix version number for setup-python 
+
+-------------------------------------------------------------------
+Sun Jul 13 13:50:02 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.7.20
+ * Enhancements
+   * Add --workspace flag to uv add 
+   * Add auto-detection for Intel GPUs 
+   * Drop trailing arguments when writing shebangs 
+   * Add debug message when skipping Python downloads 
+   * Add support for declaring multiple modules in namespace packages 
+ * Bug fixes
+   * Revert normalization of trailing slashes on index URLs 
+   * Fix forced resolution with all extras in uv version 
+   * Fix handling of pre-releases in preferences 
+   * Remove transparent variants in uv-extract to enable retries 
+ * Rust API
+   * Add method to get packages involved in a NoSolutionError 
+   * Make ErrorTree for NoSolutionError public 
+ * Documentation
+   * Finish incomplete sentence in pip migration guide 
+   * Remove cache-dependency-glob examples for setup-uv 
+   * Remove uv pip sync suggestion with pyproject.toml 
+   * Update documentation for GitHub to use setup-uv@v6 
+
+-------------------------------------------------------------------
+Sat Jul  5 00:05:00 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.7.19
+ * The uv build backend is now stable, and considered ready for production use.
+ * Enhancements
+   * Ignore Python patch version for --universal pip compile
+   * Update the tilde version specifier warning to include more context
+   * Clarify behavior and hint on tool install when no executables are available
+ * Bug fixes
+   * Make project and interpreter lock acquisition non-fatal
+   * Includes sys.prefix in cached environment keys to avoid --with collisions across projects 
+ * Documentation
+   * Add a migration guide from pip to uv projects 
 
 -------------------------------------------------------------------
 Wed Jul  2 10:33:55 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>

python-uv.spec

@@ -2,6 +2,7 @@
 # spec file for package python-uv
 #
 # Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -33,20 +34,18 @@
 %bcond_without libalternatives
 %{?sle15_python_module_pythons}
 Name:           python-uv
-Version:        0.7.18
+Version:        0.8.16
 Release:        0
 Summary:        A Python package installer and resolver, written in Rust
 License:        Apache-2.0 OR MIT
 URL:            https://github.com/astral-sh/uv
 Source0:        https://github.com/astral-sh/uv/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz
 Source1:        vendor.tar.zst
-# PATCH-FIX-UPSTREAM CVE-2025-54368.patch bsc#1247829
-Patch0:         CVE-2025-54368.patch
 BuildRequires:  %{python_module maturin}
 BuildRequires:  %{python_module pip}
 BuildRequires:  %{python_module tomli}
 BuildRequires:  alts
-BuildRequires:  cargo >= 1.86
+BuildRequires:  cargo >= 1.87
 BuildRequires:  cargo-packaging
 BuildRequires:  cmake
 BuildRequires:  fdupes