Skip to content

Redact URLs in missing-path-segment errors - #21616

Merged
woodruffw merged 1 commit into
mainfrom
zb/redact-missing-path-segments
Sep 11, 2026
Merged

woodruffw merged 1 commit into
mainfrom
zb/redact-missing-path-segments

Conversation

@astral-automations-bot

Copy link
Copy Markdown
Contributor

When RemoteSource::filename cannot extract path segments, it stores the raw URL in MissingPathSegments. URLs with an empty or opaque path can therefore expose passwords or signed query values in the error. Format that payload through the existing DisplaySafeUrl wrapper. The public error shape, successful filename extraction, and redaction policy are unchanged.

@woodruffw

Copy link
Copy Markdown
Member

NB I think the more correct thing here is for MissingPathSegments to take DisplaySafeUrl instead of String, but I'll fast-follow for that.

@astral-automations-bot
astral-automations-bot Bot force-pushed the zb/redact-missing-path-segments branch from 28bfc75 to ae173df Compare September 11, 2026 20:32
@woodruffw
woodruffw merged commit c7db143 into main Sep 11, 2026
61 checks passed
@woodruffw
woodruffw deleted the zb/redact-missing-path-segments branch September 11, 2026 21:16
@woodruffw

Copy link
Copy Markdown
Member

NB I think the more correct thing here is for MissingPathSegments to take DisplaySafeUrl instead of String, but I'll fast-follow for that.

I realized this isn't going to work because of UrlString.

luketainton pushed a commit to luketainton/repos_labmcp that referenced this pull request Sep 16, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.12` → `0.12.15` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215)

[Compare Source](astral-sh/uv@0.12.14...0.12.15)

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
`uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#&#8203;21699](astral-sh/uv#21699))

##### Performance

- Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#&#8203;21675](astral-sh/uv#21675))

##### Bug fixes

- Revert "Reject symlinked wheel installation destinations" ([#&#8203;21699](astral-sh/uv#21699))

### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214)

[Compare Source](astral-sh/uv@0.12.13...0.12.14)

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#&#8203;17110](astral-sh/uv#17110), [#&#8203;21599](astral-sh/uv#21599), [#&#8203;21603](astral-sh/uv#21603))

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#&#8203;17110](astral-sh/uv#17110))

##### Enhancements

- Resume interrupted downloads with HTTP Range requests when supported ([#&#8203;21570](astral-sh/uv#21570))
- Show underlying causes and hints in user warnings ([#&#8203;21565](astral-sh/uv#21565))
- Show resolver hints for failed `uv tool upgrade` operations ([#&#8203;21566](astral-sh/uv#21566))

##### Preview features

- Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#&#8203;21618](astral-sh/uv#21618))

##### Performance

- Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#&#8203;21619](astral-sh/uv#21619))
- Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#&#8203;21593](astral-sh/uv#21593))
- Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#&#8203;21621](astral-sh/uv#21621))

##### Bug fixes

- Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#&#8203;21672](astral-sh/uv#21672))
- Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#&#8203;21625](astral-sh/uv#21625))
- Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#&#8203;21639](astral-sh/uv#21639))
- Redact credentials and signatures from missing-path-segment URL errors ([#&#8203;21616](astral-sh/uv#21616))
- Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#&#8203;21640](astral-sh/uv#21640))
- Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#&#8203;21559](astral-sh/uv#21559))
- Suppress managed-Python fallback warnings under `--quiet` ([#&#8203;21565](astral-sh/uv#21565))
- Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#&#8203;21566](astral-sh/uv#21566))

### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213)

[Compare Source](astral-sh/uv@0.12.12...0.12.13)

Released on 2026-09-10.

##### Python

- Add GraalPy 3.13.0 ([#&#8203;21431](astral-sh/uv#21431))

##### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#&#8203;21563](astral-sh/uv#21563))

##### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#&#8203;21555](astral-sh/uv#21555))

##### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#&#8203;21279](astral-sh/uv#21279))

##### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#&#8203;18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#&#8203;21563](astral-sh/uv#21563))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43Ny4wIiwidXBkYXRlZEluVmVyIjoiNDQuNzcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=-->

Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/55
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
luketainton pushed a commit to luketainton/luke_rsu that referenced this pull request Sep 16, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.12` → `0.12.15` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215)

[Compare Source](astral-sh/uv@0.12.14...0.12.15)

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
`uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#&#8203;21699](astral-sh/uv#21699))

##### Performance

- Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#&#8203;21675](astral-sh/uv#21675))

##### Bug fixes

- Revert "Reject symlinked wheel installation destinations" ([#&#8203;21699](astral-sh/uv#21699))

### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214)

[Compare Source](astral-sh/uv@0.12.13...0.12.14)

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#&#8203;17110](astral-sh/uv#17110), [#&#8203;21599](astral-sh/uv#21599), [#&#8203;21603](astral-sh/uv#21603))

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#&#8203;17110](astral-sh/uv#17110))

##### Enhancements

- Resume interrupted downloads with HTTP Range requests when supported ([#&#8203;21570](astral-sh/uv#21570))
- Show underlying causes and hints in user warnings ([#&#8203;21565](astral-sh/uv#21565))
- Show resolver hints for failed `uv tool upgrade` operations ([#&#8203;21566](astral-sh/uv#21566))

##### Preview features

- Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#&#8203;21618](astral-sh/uv#21618))

##### Performance

- Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#&#8203;21619](astral-sh/uv#21619))
- Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#&#8203;21593](astral-sh/uv#21593))
- Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#&#8203;21621](astral-sh/uv#21621))

##### Bug fixes

- Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#&#8203;21672](astral-sh/uv#21672))
- Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#&#8203;21625](astral-sh/uv#21625))
- Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#&#8203;21639](astral-sh/uv#21639))
- Redact credentials and signatures from missing-path-segment URL errors ([#&#8203;21616](astral-sh/uv#21616))
- Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#&#8203;21640](astral-sh/uv#21640))
- Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#&#8203;21559](astral-sh/uv#21559))
- Suppress managed-Python fallback warnings under `--quiet` ([#&#8203;21565](astral-sh/uv#21565))
- Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#&#8203;21566](astral-sh/uv#21566))

### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213)

[Compare Source](astral-sh/uv@0.12.12...0.12.13)

Released on 2026-09-10.

##### Python

- Add GraalPy 3.13.0 ([#&#8203;21431](astral-sh/uv#21431))

##### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#&#8203;21563](astral-sh/uv#21563))

##### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#&#8203;21555](astral-sh/uv#21555))

##### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#&#8203;21279](astral-sh/uv#21279))

##### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#&#8203;18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#&#8203;21563](astral-sh/uv#21563))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43Ny4wIiwidXBkYXRlZEluVmVyIjoiNDQuNzcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=-->

Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/44
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
hbjydev pushed a commit to hbjydev/phoebe that referenced this pull request Sep 20, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.13` → `0.12.17` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (uv)</summary>

### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217)

[Compare Source](astral-sh/uv@0.12.16...0.12.17)

Released on 2026-09-18.

##### Enhancements

- Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#&#8203;21780](astral-sh/uv#21780))

##### Preview features

- Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#&#8203;21651](astral-sh/uv#21651))
- Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#&#8203;20746](astral-sh/uv#20746))
- Keep `uv workspace metadata` read-only unless `--sync` is provided ([#&#8203;21821](astral-sh/uv#21821))
- Apply `uv check` lock modes when retrieving workspace metadata ([#&#8203;21821](astral-sh/uv#21821))

##### Performance

- Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#&#8203;21650](astral-sh/uv#21650))
- Reduce resolver allocations when deduplicating package and distribution requests ([#&#8203;21810](astral-sh/uv#21810))

##### Bug fixes

- Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#&#8203;21825](astral-sh/uv#21825))

##### Documentation

- Clarify the 0.12.14 and 0.12.15 release notes ([#&#8203;21817](astral-sh/uv#21817))

### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216)

[Compare Source](astral-sh/uv@0.12.15...0.12.16)

Released on 2026-09-17.

##### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#&#8203;21741](astral-sh/uv#21741))

##### Enhancements

- Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#&#8203;21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#&#8203;21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#&#8203;21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#&#8203;21779](astral-sh/uv#21779))

##### Preview features

- Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#&#8203;21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#&#8203;21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#&#8203;21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#&#8203;21744](astral-sh/uv#21744))

##### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs ([#&#8203;21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached distributions ([#&#8203;21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#&#8203;20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches active version pins ([#&#8203;21742](astral-sh/uv#21742))
- Handle malformed index URLs without panicking when credentials are configured ([#&#8203;21784](astral-sh/uv#21784))
- Report a configuration error instead of panicking for proxy URLs without a host ([#&#8203;21781](astral-sh/uv#21781))
- Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#&#8203;21783](astral-sh/uv#21783))

### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215)

[Compare Source](astral-sh/uv@0.12.14...0.12.15)

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
`uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#&#8203;21699](astral-sh/uv#21699))

##### Performance

- Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#&#8203;21675](astral-sh/uv#21675))

##### Bug fixes

- Revert "Reject symlinked wheel installation destinations" ([#&#8203;21699](astral-sh/uv#21699))

### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214)

[Compare Source](astral-sh/uv@0.12.13...0.12.14)

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#&#8203;17110](astral-sh/uv#17110), [#&#8203;21599](astral-sh/uv#21599), [#&#8203;21603](astral-sh/uv#21603))

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#&#8203;17110](astral-sh/uv#17110))

##### Enhancements

- Resume interrupted downloads with HTTP Range requests when supported ([#&#8203;21570](astral-sh/uv#21570))
- Show underlying causes and hints in user warnings ([#&#8203;21565](astral-sh/uv#21565))
- Show resolver hints for failed `uv tool upgrade` operations ([#&#8203;21566](astral-sh/uv#21566))

##### Preview features

- Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#&#8203;21618](astral-sh/uv#21618))

##### Performance

- Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#&#8203;21619](astral-sh/uv#21619))
- Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#&#8203;21593](astral-sh/uv#21593))
- Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#&#8203;21621](astral-sh/uv#21621))

##### Bug fixes

- Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#&#8203;21672](astral-sh/uv#21672))
- Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#&#8203;21625](astral-sh/uv#21625))
- Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#&#8203;21639](astral-sh/uv#21639))
- Redact credentials and signatures from missing-path-segment URL errors ([#&#8203;21616](astral-sh/uv#21616))
- Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#&#8203;21640](astral-sh/uv#21640))
- Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#&#8203;21559](astral-sh/uv#21559))
- Suppress managed-Python fallback warnings under `--quiet` ([#&#8203;21565](astral-sh/uv#21565))
- Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#&#8203;21566](astral-sh/uv#21566))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45MC4yIiwidXBkYXRlZEluVmVyIjoiNDQuMTA0LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlL2dpdGh1Yi1yZWxlYXNlIiwidHlwZS9wYXRjaCJdfQ==-->

Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/632
@zanieb zanieb added the project:maintainer-followups Maintainer follow-up work label Oct 9, 2026

This branch was successfully deployed

1 active deployment
automations — ae173df4 Deployed Sep 11, 2026 by astral-automations-bot[bot] via review / security review #46478
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working project:maintainer-followups Maintainer follow-up work security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants