Proxy authentication doesn't work for uv self update on Windows

[deffi]

Summary

I'm on Windows 11 behind a corporate proxy that requires authentication. The proxy is configured via environment variable: https_proxy=http://user:[email protected]:8080 (confidential information redacted) and all required SSL certificates are installed.

uv self update fails:

C:\>uv self update 0.5.19
info: Checking for updates...
error: The installation failed. Output from the installer: Downloading uv 0.5.19 (x86_64-pc-windows-msvc)
Exception calling "DownloadFile" with "2" argument(s): "The remote server returned an error: (407) Proxy Authentication Required."

Setup

I'm running the latest version of uv (0.5.20) and it can download stuff just fine; for example:

C:\>echo %https_proxy%
http://user:[email protected]:8080

C:\>uv tool install cowsay
Resolved 1 package in 799ms
Prepared 1 package in 743ms
Installed 1 package in 10ms
 + cowsay==6.1
Installed 1 executable: cowsay.exe

My uv.toml:

native-tls=true

Issue

When I try to update uv to a different version from what is currently installed, I get an error message:

C:\>echo %https_proxy%
http://user:[email protected]:8080

C:\>uv --verbose self update 0.5.19
DEBUG uv 0.5.20 (1c17662b3 2025-01-15)
info: Checking for updates...
error: The installation failed. Output from the installer: Downloading uv 0.5.19 (x86_64-pc-windows-msvc)
Exception calling "DownloadFile" with "2" argument(s): "The remote server returned an error: (407) Proxy Authentication Required."

Additional observations

What does work is the check which versions are available (or which version is the latest):

C:\>echo %https_proxy%
http://user:[email protected]:8080

C:\>uv --verbose self update
DEBUG uv 0.5.20 (1c17662b3 2025-01-15)
info: Checking for updates...
success: You're on the latest version of uv (v0.5.20)

C:\>uv --verbose self update 0.0.0
DEBUG uv 0.5.20 (1c17662b3 2025-01-15)
info: Checking for updates...
error: The version 0.0.0 was not found for the app uv in workspace uv

I can confirm that proxy authentication is indeed read from %https_proxy% by removing the credentials and observing that it fails (but note that the error message is different):

C:\>set https_proxy=http://proxy.company:8080

C:\>uv self update
info: Checking for updates...
error: error sending request for url (https://api.github.com/repos/astral-sh/uv/releases)
  Caused by: client error (Connect)
  Caused by: proxy authentication required

On Linux (WSL on the same machine), uv self update works as expected with the same configuration:

$ echo $https_proxy
http://user:[email protected]:8080/

$ uv self update 0.5.19
info: Checking for updates...
success: Upgraded uv from v0.5.20 to v0.5.19! https://github.com/astral-sh/uv/releases/tag/0.5.19

For good measure, I also have the environment variables http_proxy, HTTP_PROXY, and HTTPS_PROXY set to the same value as https_proxy.

Versions

Windows 11, Version 23H2 (OS Build 22631.4602)
uv 0.5.20 (1c17662 2025-01-15)

[zanieb]

Thanks for the report. The updater is maintained over in axodotdev — we'll need to see what they're doing for client configuration and proxying as I believe it is outside our control.

[notatallshaw]

Looks like there's an experimental opt-in for reading system certificate store: axodotdev/axoupdater#136