Concerns with zip version 1.x

[musicinmybrain]

I am working on packaging uv for Fedora Linux. Currently, we are wary of updating the zip crate past version 0.6.x (and will hold off on doing so for now) due to concerns with how the zip-rs project project is being handled:

All releases starting with v1.0.0 were developed and released by different people than the original crate, with the hand-off being handled in a kind of weird way. Additionally, releases 1.2.0+ of the "new" zip crate contain breaking API changes which are not going to be fixed in the 1.x series.

Since uv can be made to work with version 0.6.6, would it be possible to either:

• depend on zip 0.6.6 for now, if you decide you share these concerns, or:
• at least relax the dependency to something like >=0.6.6, <2.0 to explicitly allow building with both zip v0.6 and v1?

Note that the zip crate maintainer is planning a 2.0 release in a couple of weeks.

In order to build with zip 0.6.6, with tests passing, one source change is necessary:

uv/crates/install-wheel-rs/src/wheel.rs

Line 14 in 39af09f

use zip::write::SimpleFileOptions;

needs to be use zip::write::FileOptions as SimpleFileOptions, since the SimpleFileOptions alias was added in 1.x.

If the uv project decides to change nothing, I will just carry a small downstream patch to support zip 0.6.6 for the time being.

[musicinmybrain]

See also: PyO3/python-pkginfo-rs#13

[zanieb]

We're still considering this as a team, but it seems likely we'd pin until we have more details. Would you be willing to open a pull request?

[musicinmybrain]

We're still considering this as a team, but it seems likely we'd pin until we have more details. Would you be willing to open a pull request?

Sure! I hope #3645 is what you needed. Thanks for considering this.

[AlexWaygood]

In astral-sh/ruff#11779, we're adding zip as a dependency to Ruff as well, for red-knot. For now we're pinning it to the same version that uv has it pinned to.