Skip to content

Comments

Prevent uv export from overwriting pyproject.toml#16745

Merged
charliermarsh merged 7 commits intoastral-sh:mainfrom
terror:prevent-export-overwrite
Nov 21, 2025
Merged

Prevent uv export from overwriting pyproject.toml#16745
charliermarsh merged 7 commits intoastral-sh:mainfrom
terror:prevent-export-overwrite

Conversation

@terror
Copy link
Contributor

@terror terror commented Nov 15, 2025

Currently, it's possible for uv export to overwrite someones pyproject.toml. This diff simply rejects project files passed in with -o, so we avoid doing that.

.is_some_and(|name| name.eq_ignore_ascii_case("pyproject.toml"))
{
return Err(anyhow!(
"`pyproject.toml` is reserved for project metadata; `{}` exports produce requirements files or `pylock.toml` lockfiles. Choose a different output filename.",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about this (pseudocode):

Suggested change
"`pyproject.toml` is reserved for project metadata; `{}` exports produce requirements files or `pylock.toml` lockfiles. Choose a different output filename.",
"`pyproject.toml` is not a supported output format. Supported formats: {}", ExportFormat::value_variants()
.iter()
.filter_map(|variant| variant.to_possible_value())
.map(|value| value.get_name())
.join(", ");

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I like this, just pushed up a change.

terror and others added 3 commits November 20, 2025 12:22
sorry -.- I broke my rustup and then my IDE doesn't work properly.
@konstin konstin enabled auto-merge (squash) November 20, 2025 18:58
@konstin konstin added the enhancement New feature or improvement to existing functionality label Nov 20, 2025
@konstin konstin disabled auto-merge November 20, 2025 18:58
@konstin konstin changed the title Prevent uv export from overwriting pyproject.toml Prevent uv export from overwriting pyproject.toml Nov 20, 2025
@konstin konstin enabled auto-merge (squash) November 20, 2025 18:58
auto-merge was automatically disabled November 20, 2025 22:13

Head branch was pushed to by a user without write access

@terror
Copy link
Contributor Author

terror commented Nov 20, 2025

@konstin Just pushed up a change to placate clippy.

@charliermarsh charliermarsh enabled auto-merge (squash) November 21, 2025 02:12
@charliermarsh charliermarsh merged commit b086eab into astral-sh:main Nov 21, 2025
100 of 101 checks passed
@codspeed-hq
Copy link

codspeed-hq bot commented Nov 21, 2025

CodSpeed Performance Report

Merging #16745 will degrade performances by 29.69%

Comparing terror:prevent-export-overwrite (8396e22) with main (d3a9455)

Summary

❌ 1 regression
✅ 5 untouched

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Benchmarks breakdown

Mode Benchmark BASE HEAD Change
Simulation resolve_warm_airflow 795.8 ms 1,131.9 ms -29.69%

tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Nov 27, 2025
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.9.11` -> `0.9.13` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>astral-sh/uv (astral-sh/uv)</summary>

### [`v0.9.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0913)

[Compare Source](astral-sh/uv@0.9.12...0.9.13)

Released on 2025-11-26.

##### Bug fixes

- Revert "Allow `--with-requirements` to load extensionless inline-metadata scripts" to fix reading of requirements files from streams ([#&#8203;16861](astral-sh/uv#16861))
- Validate URL wheel tags against `Requires-Python` and required environments ([#&#8203;16824](astral-sh/uv#16824))

##### Documentation

- Drop unpublished crates from the uv crates.io README ([#&#8203;16847](astral-sh/uv#16847))
- Fix the links to uv in crates.io member READMEs ([#&#8203;16848](astral-sh/uv#16848))

### [`v0.9.12`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0912)

[Compare Source](astral-sh/uv@0.9.11...0.9.12)

Released on 2025-11-24.

##### Enhancements

- Allow `--with-requirements` to load extensionless inline-metadata scripts ([#&#8203;16744](astral-sh/uv#16744))
- Collect and upload PEP 740 attestations during `uv publish` ([#&#8203;16731](astral-sh/uv#16731))
- Prevent `uv export` from overwriting `pyproject.toml` ([#&#8203;16745](astral-sh/uv#16745))

##### Documentation

- Add a crates.io README for uv ([#&#8203;16809](astral-sh/uv#16809))
- Add documentation for intermediate Docker layers in a workspace ([#&#8203;16787](astral-sh/uv#16787))
- Enumerate workspace members in the uv crate README ([#&#8203;16811](astral-sh/uv#16811))
- Fix documentation links for crates ([#&#8203;16801](astral-sh/uv#16801))
- Generate a crates.io README for uv workspace members ([#&#8203;16812](astral-sh/uv#16812))
- Move the "Export" guide to the projects concept section ([#&#8203;16835](astral-sh/uv#16835))
- Update the cargo install recommendation to use crates ([#&#8203;16800](astral-sh/uv#16800))
- Use the word "internal" in crate descriptions ([#&#8203;16810](astral-sh/uv#16810))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4xOS43IiwidXBkYXRlZEluVmVyIjoiNDIuMjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90Il19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or improvement to existing functionality

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants