# Data flow — astral-sh/uv

> Canonical page: https://codevetter.com/unpack/uv/data-flow

# Data flow — astral-sh/uv

Scanned commit a9e231a7e377342084d1c0b6009409bdec41acc5 (2026-09-21). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

User input enters as CLI arguments, environment variables, and config files, and is merged into typed settings before any network call. Project metadata is discovered from pyproject.toml workspaces or PEP 723 scripts, lowered into requirements, and solved against PEP 503/691 index metadata. The solver output becomes a uv.lock (version 1) which later commands treat as the source of installable pins. Artifacts are fetched into named cache buckets and linked into a virtual environment. Credentials are attached by HTTP middleware and must not be copied into new URLs, logs, or cache keys.
- Documented configuration search reads a pyproject.toml [tool.uv] table or a uv.toml in the current directory or the nearest parent. In a workspace the search starts at the workspace root and member config is ignored. tool commands skip local files and read only user config (for example ~/.config/uv/uv.toml) and system config (for example /etc/uv/uv.toml). — [docs/concepts/configuration-files.md#L1-L37](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/docs/concepts/configuration-files.md#L1-L37)
- run() merges filesystem options in this order: an explicit --config-file (FilesystemOptions::from_file), or none when UV_NO_CONFIG or isolated mode is set. Tool and self commands use FilesystemOptions::user combined with system only. Otherwise Workspace::discover then FilesystemOptions::find(workspace.install_path()) is combined with user and then system. A pyproject.toml passed as --config-file warns; --project is the supported switch. — [crates/uv/src/lib.rs#L300-L347](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/lib.rs#L300-L347)
- Combine prefers the left-hand options, matching Cargo's layered config except that higher-precedence array items are placed earlier. Implemented for FilesystemOptions, Options, PipOptions, and AuditOptions in uv-settings. — [crates/uv-settings/src/combine.rs#L25-L78](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-settings/src/combine.rs#L25-L78)
- Environment variables consumed by clap and settings include UV_CACHE_DIR, UV_NO_CACHE, UV_PYTHON, UV_PYTHON_DOWNLOADS, UV_PYTHON_PREFERENCE, UV_INDEX, UV_DEFAULT_INDEX, UV_INDEX_URL, UV_EXTRA_INDEX_URL, UV_FIND_LINKS, UV_LINK_MODE, UV_KEYRING_PROVIDER, UV_NATIVE_TLS, UV_SYSTEM_CERTS, UV_REQUIRE_HASHES, UV_LOCKED, UV_FROZEN, UV_NO_CONFIG, UV_CONFIG_FILE, UV_CREDENTIALS_DIR, and UV_OFFLINE. They are constants on uv_static::EnvVars. — [crates/uv-static/src/env_vars.rs#L32-L242](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-static/src/env_vars.rs#L32-L242)
- Index metadata is fetched by RegistryClient::simple_detail, which implements PEP 503 and PEP 691. --no-index returns ErrorKind::NoIndex. IndexStrategy::FirstIndex queries indexes serially; each hit is simple_detail_single_index, which uses fetch_remote_simple_detail or fetch_local_simple_detail. Responses are cached as rkyv under the Simple bucket. — [crates/uv-client/src/registry_client.rs#L338-L376](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-client/src/registry_client.rs#L338-L376) [crates/uv-cache/src/lib.rs#L1267-L1274](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-cache/src/lib.rs#L1267-L1274) [crates/uv-cache/src/lib.rs#L1313](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-cache/src/lib.rs#L1313)
- Resolution output is stored as Lock. The on-disk major version constant is VERSION = 1. A uv version supports a single major version; revision changes stay readable by older uv versions that share that major. Lock::from_toml parses the file and Lock::to_toml serializes it. Export paths in uv-lock include requirements.txt, pylock.toml, and CycloneDX JSON. — [crates/uv-lock/src/lock/mod.rs#L88-L104](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-lock/src/lock/mod.rs#L88-L104) [crates/uv-lock/src/lock/mod.rs#L293-L321](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-lock/src/lock/mod.rs#L293-L321) [crates/uv-lock/src/lib.rs#L1-L10](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-lock/src/lib.rs#L1-L10)
- do_lock lowers requirements, overrides, constraints, and dependency groups through LockTarget::lower, builds preferences and fork markers from an existing lock, calls pip::operations::resolve, then Lock::from_resolution. Unchanged locks are detected by equality or by comparing to_toml text when format checking is on. commit writes the TOML to the lock path with fs_err::tokio::write. — [crates/uv/src/commands/project/lock.rs#L540-L624](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/commands/project/lock.rs#L540-L624) [crates/uv/src/commands/project/lock.rs#L1055-L1153](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/commands/project/lock.rs#L1055-L1153) [crates/uv/src/commands/project/lock_target.rs#L404-L408](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/commands/project/lock_target.rs#L404-L408)
- pip::operations::resolve partitions named and unnamed requirements, resolves unnamed ones with NamedRequirementsResolver, then constructs Resolver::new and awaits Resolver::resolve. Resolver::resolve runs a metadata fetcher and spawns a thread named uv-resolver whose solve method initializes a PubGrub State. — [crates/uv/src/commands/pip/operations.rs#L104-L166](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/commands/pip/operations.rs#L104-L166) [crates/uv/src/commands/pip/operations.rs#L379-L410](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/commands/pip/operations.rs#L379-L410) [crates/uv-resolver/src/resolver/mod.rs#L290-L348](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-resolver/src/resolver/mod.rs#L290-L348)
- Installation uses pip::operations::install, which builds an InstallationPlan from the resolution and SitePackages, then plan.execute. LinkMode is clone (copy-on-write, serde alias reflink) by default on macOS and Linux, and hardlink elsewhere. Other modes are copy and symlink, selected by UV_LINK_MODE. — [crates/uv/src/commands/pip/operations.rs#L684-L747](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv/src/commands/pip/operations.rs#L684-L747) [crates/uv-fs/src/link.rs#L13-L49](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-fs/src/link.rs#L13-L49)
- Cache buckets and current directory names include SourceDistributions sdists-v9, Wheels wheels-v6, Simple simple-v25, FlatIndex flat-index-v5, Git git-v0, Interpreter interpreter-v4, Archive archive-v0, Files files-v0, Builds builds-v0, Environments environments-v2, Python python-v0, Binaries binaries-v0, and Osv osv-v0. Wheels and sdists are keyed by origin (pypi, index digest, git, or URL). — [crates/uv-cache/src/lib.rs#L1188-L1326](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-cache/src/lib.rs#L1188-L1326)
- Credentials are Credentials::Basic or Bearer. TextCredentialStore persists them as credentials.toml under UV_CREDENTIALS_DIR or StateBucket::Credentials, guarded by an exclusive credentials.toml.lock. AuthBackend::from_settings uses KeyringProvider::native only when PreviewFeature::NativeAuth is enabled; otherwise it uses the plaintext store. AuthMiddleware can attach a keyring provider, indexes, and an only_authenticated flag. — [crates/uv-auth/src/store.rs#L21-L54](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-auth/src/store.rs#L21-L54) [crates/uv-auth/src/store.rs#L239-L270](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-auth/src/store.rs#L239-L270) [crates/uv-auth/src/credentials.rs#L25-L25](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-auth/src/credentials.rs#L25-L25) [crates/uv-auth/src/middleware.rs#L175-L285](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-auth/src/middleware.rs#L175-L285)
- Managed CPython downloads use the prefix https://github.com/astral-sh/python-build-standalone/releases/download/ unless an Astral mirror base is appended with /github/python-build-standalone/releases/download/. ManagedPythonDownload carries a url and an optional sha256. The download catalog can be overridden with python_downloads_json_url. — [crates/uv-python/src/downloads.rs#L195-L226](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-python/src/downloads.rs#L195-L226) [crates/uv-python/src/downloads.rs#L1027-L1039](https://github.com/astral-sh/uv/blob/a9e231a7e377342084d1c0b6009409bdec41acc5/crates/uv-python/src/downloads.rs#L1027-L1039)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)