Quick Answer
uv preserves query parameters when recording the origin of an archive package while removing username and password credentials from that metadata URL. The fix helps it recognize an unchanged direct-URL installation.
In Plain English
A package URL can contain more than a file path. Its query string may carry an encoded signature or identify the requested object. If recorded metadata changes that identity, a later installation check can conclude that the installed package came from somewhere else.
Code Evidence
In crates/uv-pypi-types/src/parsed_url.rs, archive metadata conversion uses without_credentials before producing the URL string. A regression test installs a wheel from a URL with encoded query parameters, examines direct_url.json, and checks a second dry run and installation. The expected dry run reports that no changes are needed.
Why It Matters
The distinction matters for teams distributing internal packages through signed links. Our interpretation is that preserving source identity improves repeatability, while stripping user-info credentials serves a different purpose. Those objectives are compatible, but they should not be collapsed into a blanket claim that all secrets are removed.
Origin Metadata Must Preserve Identity
The recorded origin of a direct archive installation is useful only if it remains meaningfully connected to the URL the installer was asked to use. Removing or changing a query string can turn two different references into the same recorded address, or make a later comparison disagree with the original request. The regression test focuses on that second problem by checking the metadata and then revisiting the installation.
Encoding is part of this case. A query can contain characters represented through URL encoding, and a signature may depend on how the request is represented. The source evidence here is the test's encoded query parameters and its expected metadata. It should not be expanded into a promise that every package server accepts every equivalent-looking encoding. The relevant fix is preserving the archive URL information through this particular conversion.
A Signed Package Link Scenario
Consider a team distributing a wheel through an internal service that supplies a signed archive link. The first installation succeeds, but a subsequent command needs to decide whether the installed distribution already satisfies the same direct reference. If the origin metadata has lost the query information, a comparison can treat the installed source as different even though the developer supplied the same link.
The patch's regression sequence is helpful because it checks more than a string in isolation. It installs a wheel, inspects direct_url.json, and examines the next dry run and installation. The expected dry run says no changes are required. That sequence connects serialization to the user-facing decision it supports. We have not run this sequence against an internal service, and a freshly issued link with a different signature is a separate comparison case.
Credentials and Query Values Are Different
The implementation uses without_credentials before converting the metadata URL to a string. In this context, the stated removal covers username and password information in the URL's user-info portion. A query parameter can also carry a sensitive value, but it occupies a different part of the URL. Preserving query identity and removing user-info therefore do not amount to universal secret redaction.
For an operational review, inspect how the organization's package URLs are formed and where installed metadata is copied. For example, a build artifact or diagnostic bundle might include the environment's package metadata. If the query contains a reusable credential or a time-limited signature, that should inform handling of the bundle. The patch does not establish the lifetime or authority of any particular service's signature, so those details belong to the service's own policy.
A Focused Verification Plan
Use a disposable environment and a package URL whose behavior is understood. Record the uv version, install the direct reference, and inspect the relevant direct_url.json without copying secret-bearing values into public logs. Confirm that the query information needed to identify the requested archive is present and that user-info credentials are absent. Then use the same reference in a dry run and examine whether uv proposes changes.
Keep the link constant during that comparison. Regenerating it between steps may change its identity and make the result difficult to interpret. If the service expires links, distinguish an authentication or download failure from the metadata comparison this patch addresses. A no-change decision also does not demonstrate that an expired URL would remain downloadable in a fresh environment.
The practical lesson is to test both the stored representation and the decision made from it. A metadata file can look plausible while a later comparison still behaves unexpectedly. Here the source provides evidence for both layers through the regression expectations, while the scope remains archive-origin conversion rather than a complete audit of package provenance or credential handling.
An Open Question
Can the preserved query string itself contain sensitive material? It can, and the test deliberately includes a signature value. Teams should treat installed origin metadata according to the sensitivity of their package URLs, rather than assuming credential removal means every token is redacted.
Scope and Limitations
We inspected the metadata conversion and test expectations. We did not test a private package service. The release notes place the fix in uv 0.12.19.