Vinta ChenandClaude 25618e2121 docs: warn that renaming an entry can expose it to the pypi sweep ...

The uv-audit bug has no automatic guard outside the bundled-entry
case, so the hazard has to live in the audit process instead. The
sweep only queries names matching PYPI_NAME_RE, so a display name
with a space is skipped outright; renaming it into a PyPI-shaped name
starts it being queried, which is how 'uv audit' became 'uv-audit'
and picked up an unrelated third-party package by rocshers.

The gotcha tells the auditor to fetch PyPI metadata for any renamed
entry and add a null override when the package isn't the linked
project. It also records two broader checks that were measured
against the full list and rejected, so a future audit doesn't spend
time re-proposing them: the repo-backlink check misses this case
entirely since uv-audit declares no repo URL, as do 26 legitimate
entries, and it flags 10 benign org moves; the name-versus-repo-name
check returns 46 hits that are all legitimate, including uv-build
with the shape identical to uv-audit.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-08-23 01:49:40 +08:00

..

skills

docs: warn that renaming an entry can expose it to the pypi sweep

2026-08-23 01:49:40 +08:00

settings.json

config: add Claude permissions settings

2026-01-08 15:59:54 +08:00