Releases: astral-sh/uv
Release list
0.12.5
Release Notes
Released on 2026-08-14.
Python
- Add CPython 3.10.21, 3.11.16, and 3.12.14 (#21138)
- Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (#21134)
Enhancements
- Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (#21130)
Preview features
- Allow
--indexand--default-indexto select configured package indexes by name with theindex-by-namepreview feature (#17455) - Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (#21131)
- Fall back to logical file sizes when using
cache-physical-spaceon filesystems that do not support physical-space accounting (#21133)
Bug fixes
- Resolve relative package index paths in PEP 723 scripts against the script directory (#21097)
Install uv 0.12.5
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.ps1 | iex"Download uv 0.12.5
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.12.4
Release Notes
Released on 2026-08-13.
Enhancements
- Prefer post-quantum key exchange and enable opt-in TLS diagnostics (#21054)
- Accept whitespace before versions in noncompliant wildcard comparisons such as
Requires-Python: >= 3.5.*(#21012) - Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (#20944)
- Omit source-span carets from diagnostics for empty PEP 508 requirements (#21094)
Preview features
- Add
uv check --no-install-projectand respectUV_NO_INSTALL_PROJECTto install dependencies without building or installing the project (#21085) - Make the ty subprocess invoked by
uv checkhonor uv's color and progress settings, including quiet mode (#21086)
Performance
- Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (#20804)
- Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (#21041)
Bug fixes
- Use windowed
pythonw.exelaunchers for virtual environments created from managed Python minor-version links (#19235) - Allow
uv lockto proceed when.venvis an unusable project environment (#21068) - Respect
fork-strategywhen ordering forks created fromenvironmentsor existing lockfileresolution-markers(#21000) - Preserve consecutive wildcard Python minor-version exclusions such as
!=3.11.*, !=3.12.*inuv.lock(#21045) - Preserve inline comments on the final item in dependency arrays when
uv addupdates it (#21008) - Recover from stale base-interpreter cache metadata when an existing virtual environment exposes a version mismatch (#21073)
- Prevent interpreter cache reuse across different
PYTHONEXECUTABLEand__PYVENV_LAUNCHER__overrides (#21075) - Show standard styling, usage guidance, and line termination for invalid
uv version --bumpvalues (#21076)
Install uv 0.12.4
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.4/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.4/uv-installer.ps1 | iex"Download uv 0.12.4
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.12.3
Release Notes
Released on 2026-08-07.
Python
- Add CPython 3.13.15 (#20997)
Preview features
- Add
--output-formatto select automatic, human-readable, or raw-byte output foruv cache size(#20992) - Preserve JSON output from
uv workspace metadata --quietwhile suppressing diagnostics (#20991) - Reduce memory usage for large workspaces by streaming
uv workspace metadataJSON output (#20990)
Performance
- Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#20989)
- Reuse compiled workspace exclusion patterns during workspace discovery (#20988)
- Speed up conflict-heavy resolutions by avoiding materialized range complements (#20982)
- Avoid slow procfs reads during Python interpreter discovery on Linux (#20987)
Documentation
- Add PEP 740 attestations to the GitHub Actions publishing example (#20986)
- Restrict the GitHub Actions publishing example to Python version tags (#20973)
- Correct
--python-pinto--pin-pythonin theuv init --bareexample (#20876)
Install uv 0.12.3
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.ps1 | iex"Download uv 0.12.3
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.12.2
Release Notes
Released on 2026-08-05.
Python
Enhancements
- Ensure diagnostic hints end with a newline to prevent malformed terminal output (#20959)
Preview features
- Audit one or all installed tools with
uv tool audit(#20921) - Report physically reclaimed disk space during cache cleanup with the
cache-physical-spacepreview feature (#20925)
Configuration
- Add
UV_RUN_RLIMIT_NOFILEto set the open-file limit for commands launched byuv run(#20926)
Performance
- Speed up
uv.lockparsing for wheel entries (#20881) - Speed up
uv.lockparsing for source distribution entries (#20882) - Speed up filename extraction from distribution URLs (#20879)
- Reduce filesystem metadata lookups during bytecode compilation (#20928)
- Reuse file metadata when building source distributions (#20927)
Bug fixes
- Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions (#20963)
- Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested (#20930)
Documentation
- Separate build and publish jobs in the GitHub Actions publishing guide (#20946)
- Ensure the GitHub Actions publishing example waits for the build job to finish (#20957)
- Correct typos in the Docker integration guide (#20970)
Install uv 0.12.2
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.2/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.2/uv-installer.ps1 | iex"Download uv 0.12.2
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.12.1
Release Notes
Released on 2026-07-31.
Enhancements
- Add package-specific pre-release policies with
--prerelease-package(#20837) - Support local HTML files as flat indexes (#20802)
- Add Xonsh virtual environment activation scripts (
activate.xsh) (#19740) - Preserve filesystem paths passed to
uv add --indexwhen updatingpyproject.toml(#20817)
Preview features
- Add automatic fixes to
uv checkwith--fix(#20793) - Avoid rejecting unchanged metadata-free lockfiles when workspace dependencies share direct sources (#20847)
- Honor direct URL constraints when validating metadata-free lockfiles (#20796)
- Ignore malformed PEP 723 scripts discovered during project checks (#20784)
- Use ty's native script exclusion in
uv check(#20742)
Performance
- Parse canonical uv lockfiles directly, with a fallback for other valid TOML syntax (#20648)
- Accelerate SHA-256 hashing on non-Windows ARM64 platforms (#20805)
Bug fixes
- Flush shell startup file updates before
uv tool update-shellanduv python update-shellexit (#20842) - Make workspace-root dependency groups available to commands run from workspace members (#20840)
- Resolve
--find-linkspaths in requirements files relative to the containing file (#20832) - Respect configured indexes in
uv tool list --outdated(#20770)
Documentation
- Document Astral GPU indexes in the PyTorch guide (#20785)
- Use consistent dependency-group argument descriptions throughout the CLI documentation (#20823)
Install uv 0.12.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-installer.ps1 | iex"Download uv 0.12.1
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.12.0
Release Notes
Released on 2026-07-28.
Since we released uv 0.11.0 in March, we've accumulated changes that improve correctness, safety, and compatibility with specifications, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution.
We expect most users to be able to upgrade without making changes.
There are no breaking changes to the configuration of the uv build backend. If your [build-system] table includes an upper bound on uv_build, update it to allow uv_build 0.12, e.g., uv_build>=0.11.32,<0.13.
Breaking changes
-
Define build systems by default with
uv init(#19197)Projects created with
uv initnow declare a build system and are packaged by default. This was the default project layout all the way back in v0.3, but we found that the use of thehatchlingbuild system was confusing to newcomers and consequently dropped use of a build system by default in v0.4. Since then, we've created our own build system (uv_build) with tight integration with uv and are excited to restore the default to a best-practice project layout.Previously,
uv init examplecreated an unpackaged layout containingmain.pyand apyproject.tomlwithout a build system. The project could declare dependencies but was not itself installed into its virtual environment.Now,
uv init exampledefines a[build-system]usinguv_build, places application source code insrc/example, and includes a[project.scripts]entry namedexample. Defining a build system allows the project to be imported from tests or other code, installed as a dependency, and run as a command:$ uv init example $ cd example $ uv run example Hello from example!
Existing projects are unaffected. Use
uv init --no-package exampleto create the previous unpackaged layout without a build system.See the project creation documentation for more details.
This stabilizes the
packaged-initpreview feature. -
Reject unsupported source distribution and wheel archive formats (#18927)
PEP 625 requires source distributions to use
.tar.gzarchives. Previously, uv also accepted legacy formats such as.tar.bz2and.tar.xz. Those formats are now rejected, including when referenced by an existing lockfile. Legacy.zipsource distributions remain supported for backwards compatibility.Wheels and other ZIP archives can no longer contain entries compressed with bzip2, LZMA, or XZ. Entries must use the stored, DEFLATE, or zstd compression methods.
Removing support for uncommon compression methods reduces uv's compression dependencies and the attack surface exposed when processing untrusted packages.
You cannot opt out of this behavior. If you depend on a legacy source distribution that uses an unsupported format, we recommend rebuilding it as a
.tar.gzarchive and regenerating any lockfile containing references to the legacy archive. -
Reject wheel files that could replace the Python interpreter (#20748, #20749)
uv already rejected wheel entry points named
python, but case variants such asPythonwere still accepted. On case-insensitive filesystems, including common macOS and Windows setups, these entry points could overwrite the virtual environment's interpreter.Wheels could also place interpreter files in their
.data/scriptsdirectory or in paths such as.data/data/bin/python, bypassing the entry-point check and replacing the interpreter during installation.uv now rejects case-insensitive variants of reserved interpreter names and wheel data files that would be installed over an interpreter. This includes names such as
Python,python.py, andPython.exe, along with other reserved interpreter names and their versioned variants.You cannot opt out of these checks. Rename conflicting entry points or wheel data files and rebuild the affected wheel.
-
Prefer stable releases before falling back to pre-releases (#19993)
A dependency can introduce a pre-release requirement after resolution starts. uv previously required each package's pre-release eligibility to be known before resolution began: the default
if-necessary-or-explicitmode allowed them for direct requirements that explicitly requested a pre-release, or for packages that only published pre-releases.This meant that a pre-release requirement discovered in a dependency's metadata, e.g.,
example>=2.0.0b1, would fail to resolve even when a compatible pre-release existed. To resolve it, you had to add that dependency as a direct requirement or allow pre-releases across your entire dependency graph.The default mode is now
if-necessary. uv tries stable candidates first and falls back to pre-releases when no stable candidate satisfies the active constraints. Like pip, uv now supports pre-release requirements discovered transitively, but can select different versions than previous uv releases when both stable and pre-release candidates are available.You can opt out of automatic pre-release selection with
--prerelease disallow. Alternatively,--prerelease allowconsiders pre-releases without first preferring stable releases, and--prerelease explicitonly allows them for direct requirements that mention a pre-release.The old
if-necessary-or-explicitmode distinguished between explicitly requested pre-releases and packages with no stable releases. That distinction is unnecessary now thatif-necessaryhandles both cases, including transitive requirements. The old name remains available as an alias but is deprecated and will be removed in a future release. -
Respect
--require-hashesdirectives inrequirements.txt(#19336)Previously,
uv pip installanduv pip syncwarned about--require-hashesinside arequirements.txtfile but still installed dependencies without checking their hashes. Now, the directive enables hash-checking mode, just as if--require-hasheshad been passed on the command line.For example, this requirements file is no longer accepted because the requirement is neither pinned nor hashed:
--require-hashes anyioYou cannot opt out while the directive is present. Pin every requirement with
==and provide its hash, or remove--require-hashesif hash checking is not intended. -
Reject MD5-only hashes in hash-checking mode (#20758)
Previously,
uv pip install --require-hashesanduv pip sync --require-hashesaccepted requirements whose only available digest used MD5. MD5 is not collision-resistant, so relying on it undermined installations that require hash verification and differed from pip's behavior.Hash-checking mode now requires at least one secure digest for every requirement. For example, the following requirement is rejected unless a secure hash, such as SHA-256, is also supplied:
anyio==4.0.0 --hash=md5:420d85e19168705cdf0223621b18831aA secure hash can be supplied directly on the requirement or in a matching constraints file. Ordinary hash verification without
--require-hashescontinues to support MD5.You cannot opt out while hash checking is required. Regenerate affected hashes with SHA-256 or another supported secure hash.
-
Reject invalid
pylock.tomlfiles and artifacts (#20402, #20440, #20443)uv now validates additional requirements from the
pylock.tomlspecification:- The
packagesarray must be present. Previously, uv interpreted a missing array as an empty lockfile, souv pip synccould uninstall an environment instead of rejecting malformed input. An explicitly emptypackages = []array remains valid. - Lockfile filenames must be
pylock.tomlor a single-name variant such aspylock.dev.toml. Names such aspylock..tomlandpylock.foo.bar.tomlare rejected. - If a wheel, source distribution, or other artifact declares a
size, the downloaded or cached artifact must match. Previously, an incorrect size was accepted when the hash was correct. Sizes reported by package indexes remain advisory.
You cannot opt out of these checks. Regenerate malformed lockfiles, rename invalid filenames, and either correct or remove an incorrect optional
sizevalue. - The
-
Honor explicit certificate overrides even when no certificates can be loaded (#20741, #20767)
Previously, uv ignored
SSL_CERT_FILEorSSL_CERT_DIRvalues that pointed to missing or inaccessible paths, empty files or directories, or sources without valid certificates. Instead, it fell back to its default trust roots, potentially allowing HTTPS connect...
0.11.33
Release Notes
Released on 2026-07-28.
Enhancements
- Abort panics in release builds for smaller uv binaries (#20271)
- Use
.tar.gzarchives for Pyodide installs (#20667)
Preview features
- Avoid checking any scripts in
uv checkunless--scriptis passed (#20676) - Check locked tools for malware before cache reuse (#20301)
- Write and read
package.metadata-free lockfiles (#20688, #20691, #20685, #20695)
Bug fixes
- Correctly split dependencies into production and optional markers (#20671)
- Fix discrepancies in argument parsing of exclude-newer (#20679)
- Cleanup managed Python temporary directory on error (#20752)
Install uv 0.11.33
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-installer.ps1 | iex"Download uv 0.11.33
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.11.32
Release Notes
Released on 2026-07-23.
Preview features
- Add
--packageand--all-packagesselection touv check(#20628) - Allow
uv upgradeto update multiple marker-specific declarations of the same package (#20335) - Reject non-canonically formatted lockfiles in
uv lock --checkand commands using--locked(#20646) - Regenerate non-canonically formatted lockfiles with
uv lock --refresh(#20634) - Include best-effort information about the active environment in
uv workspace metadataby default (#20643)
Performance
- Skip dependency-group conflict expansion when no additional conflicts can be inferred (#20611)
Bug fixes
- Fork universal resolutions when
Requires-Pythonis discovered only from distribution metadata (#20586)
Install uv 0.11.32
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"Download uv 0.11.32
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.11.31
Release Notes
Released on 2026-07-21.
Enhancements
- Allow workspace sources to reference members in another workspace by path (#18401)
- Support
.venvfiles containing paths to centralized project environments (#20022) - Update bundled Windows timezone data to IANA 2026c (#20554)
Preview features
- Add an index-specific
hash-algorithmsetting for lockfile generation (#20605)
Configuration
- Add
audit.malware-checkandaudit.malware-check-urlsettings (#20587)
Performance
- Avoid quadratic work when deduplicating transitive conflicts (#20578)
Bug fixes
- Suggest
--emit-build-optionsfor unsupporteduv pip compile --emit-options(#20582) - Reject source distributions and wheels with mismatched package names (#20432)
- Avoid retrying TLS certificate verification failures (#16245)
- Avoid warnings about
uv_buildsettings for in-tree build backends (#20153)
Install uv 0.11.31
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"Download uv 0.11.31
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.11.30
Release Notes
Released on 2026-07-20.
Python
- Add CPython 3.15.0b4 (#20519)
Preview features
- Allow
uv workspace metadata --syncto target the active virtual environment with--active(#20500) - Reuse centralized project environments when workspaces are accessed through symlinks (#20436)
Performance
- Skip resolver candidates whose files are all excluded by
exclude-newer(#20460) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead (#20427)
- Accelerate lockfile serialization with
toml_writer(#20450) - Compact cached Simple API distribution metadata and hashes (#20463, #20483)
- Decode stale cache entries in a single blocking task (#20486)
- Decode cached payloads outside resolver workers (#20464)
- Cache resolver Python requirement markers (#20461)
- Reuse resolver fork markers while recording preferences (#20462)
Bug fixes
- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall (#20429)
- Preserve literal
extends-environmentpaths inpyvenv.cfgon Unix (#20466)
Documentation
Install uv 0.11.30
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.ps1 | iex"Download uv 0.11.30
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>