uv

Release Notes

Released on 2026-10-01.

Python

• Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (#22147)

Enhancements

• Accept uppercase release suffixes in wheel platform tags (#22113)
• Record workspace-member default groups in lockfiles (#22010, #22103)
• Record workspace-member dependency-group Python requirements in lockfiles (#22044, #22103)
• Record default groups for non-project workspace roots in lockfiles (#22104)
• Record dependency-group Python requirements for non-project workspace roots in lockfiles (#22104)
• Format URLs and paths consistently in CLI messages (#21937)
• Hide the unsupported --offline option from uv publish help (#22124)

Preview features

• Honor --no-default-groups in uv audit (#22090)
• Report a clear error when uv audit or uv tool audit runs offline and hide the unsupported option from help (#22114)

Configuration

• Add UV_PYTHON_ARCH to select an interpreter architecture independently of its Python version (#22098)

Performance

• Reduce uv's binary size by compressing embedded Python download metadata (#22126)

Bug fixes

• Verify unchanged requirements against existing lockfile hashes when relocking (#22083)
• Honor dependency-group Python requirements at non-project workspace roots (#22101)
• Use each selected workspace member's recorded default groups during frozen sync (#22015)
• Avoid false entry-point warnings for required workspace members (#22112)

Other changes

• Raise the minimum supported Rust version for building uv to 1.97 and update the toolchain to Rust 1.99 (#22121)

Install uv 0.12.22

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.ps1 | iex"

Download uv 0.12.22

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-29.

Python

• Update CPython to use OpenSSL 3.5.9 (#22076)

Enhancements

• Omit empty [manifest] tables from lockfiles that contain only manifest subtables (#22070)

Preview features

• Omit redundant runtime constraints from uv.lock, including those involving pre-releases, with the resolution-inputs preview feature (#22004, #22068)

Bug fixes

• Prevent uv python pin --rm from removing a global .python-versions file without --global (#21992)
• Fix installed-package checks incorrectly reporting post-releases as incompatible with exclusive lower bounds on pre-releases (#22049)

Install uv 0.12.21

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.21/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.21/uv-installer.ps1 | iex"

Download uv 0.12.21

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-28.

Enhancements

• Reuse lockfiles when dependency declarations are semantically equivalent (#21951)
• Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#21990)

Preview features

• Write normalized requirement declarations with the lockfile-normalization preview feature (#21951)
• Honor synthetic default groups when installing or syncing from pylock.toml (#22003)
• Resolve local paths in exported pylock.toml files relative to the output file (#22042)
• Install each package only once when repeated tool-install-locks requirements resolve to the same package (#22000)
• Reuse lock-without-metadata lockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)
• Use consistent root-package paths in uv workspace metadata and uv tree --format json output (#22050)

Configuration

• Continue searching XDG_CONFIG_DIRS after empty entries (#21987)

Performance

• Restore the previous HTTP cache-write scheduling while investigating severe cache-revalidation stalls on ext4 filesystems (#22051)

Bug fixes

• Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#21996)
• Allow metadata builds for first-party workspace projects under --no-build (#21988)
• Honor project exclusion flags with --all-packages, including --no-install-project and --no-emit-project (#21994)
• Restore pyproject.toml if uv upgrade fails or is interrupted (#21983)
• Generate working Nushell activation scripts for relocatable virtual environments (#21979)
• Prevent commands from running and changing state after displaying --show-settings (#21989)
• Treat UTF-16 requirements files containing only a byte-order mark as empty (#21991)
• Ignore unrecognized managed-Python implementation directories during uv python list and uv python upgrade instead of panicking (#22033)
• Avoid panics and incorrect rewriting when managed Python sysconfig paths merely start with /install (#22036)
• Report whitespace-only non-ASCII requirements as invalid instead of panicking (#22035)
• Avoid a resolver panic when trace logging an always-false constraint (#22034)

Install uv 0.12.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.20/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.20/uv-installer.ps1 | iex"

Download uv 0.12.20

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

• Format upload URLs with backticks in uv publish errors (#21934)

Preview features

• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)
• Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

• Make individual preview-feature reference entries linkable by name (#21950)

Install uv 0.12.19

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"

Download uv 0.12.19

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

• Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

• Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
• Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
• Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
• Reject archive entries that normalize to absolute Windows paths (#21923)
• Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
• Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
• Avoid rebuilding a Windows relative path into an absolute form (#21923)

Install uv 0.12.18

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex"

Download uv 0.12.18

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-18.

Enhancements

• Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#21780)

Preview features

• Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#21651)
• Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#20746)
• Keep uv workspace metadata read-only unless --sync is provided (#21821)
• Apply uv check lock modes when retrieving workspace metadata (#21821)

Performance

• Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#21650)
• Reduce resolver allocations when deduplicating package and distribution requests (#21810)

Bug fixes

• Prevent required-environments from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline (#21825)

Documentation

• Clarify the 0.12.14 and 0.12.15 release notes (#21817)

Install uv 0.12.17

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex"

Download uv 0.12.17

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
• Use the bundled uv_build backend only when its version matches active version pins (#21742)
• Handle malformed index URLs without panicking when credentials are configured (#21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

Install uv 0.12.16

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 | iex"

Download uv 0.12.16

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-15.

Performance

• Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#21675)

Bug fixes

• Fix regressions in 0.12.14 when installing to symlinked destinations or using uv pip install --target . (#21699)

Install uv 0.12.15

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.15/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.15/uv-installer.ps1 | iex"

Download uv 0.12.15

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-15.

Enhancements

• Resume interrupted downloads with HTTP Range requests when supported (#21570)
• Use a consistent format for error rendering (#17110)
• Render error and warning causes with compact cause: labels (#21599, #21603)
• Show underlying causes and hints in user warnings (#21565)
• Show resolver hints for failed uv tool upgrade operations (#21566)

Preview features

• Export multiple dependency selections from a shared lockfile in one uv export --batch invocation with the batch-export preview feature (#21618)

Performance

• Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task (#21619)
• Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers (#21593)
• Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task (#21621)

Bug fixes

• Select releases that satisfy required-environments within each resolver fork instead of combining incompatible wheel coverage across forks (#21672)
• Install packages with paths longer than MAX_PATH on Windows systems without long-path support enabled (#21625)
• Prevent uv python install from overwriting valid unmanaged Python symlinks with relative targets on Unix (#21639)
• Redact credentials and signatures from missing-path-segment URL errors (#21616)
• Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation (#21640)
• Prefer bin/python over bin/python3 when discovering interpreters in Unix environments (#21559)
• Classify package-operation exit codes by their underlying cause: return 1 for expected failures and 2 for recognized operational and internal failures (#17110)
• Suppress managed-Python fallback warnings under --quiet (#21565)
• Keep failed uv tool upgrade errors visible with -q while suppressing them with -qq (#21566)

Install uv 0.12.14

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.14/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.14/uv-installer.ps1 | iex"

Download uv 0.12.14

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-10.

Python

• Add GraalPy 3.13.0 (#21431)

Enhancements

• Verify hashes when downloading PEP 658 metadata sidecars (#21563)

Preview features

• Respect ty exclusions when uv check automatically selects members of a virtual workspace (#21555)

Performance

• Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#21279)

Bug fixes

• Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#18713)
• Prefer core-metadata over legacy aliases in JSON index responses (#21563)

Install uv 0.12.13

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"

Download uv 0.12.13

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

• Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#21539)

Install uv 0.12.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.ps1 | iex"

Download uv 0.12.12

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-08.

Preview features

• Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#20146)
• Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#21462)

Performance

• Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#21478)
• Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#21468)
• Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#21500)
• Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#21499)
• Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#21523)

Bug fixes

• Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#21223)
• Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#21543)
• Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#21544)
• Support PowerShell virtual environment activation from UNC paths, including WSL paths (#19159)
• Trim surrounding whitespace from entries in .python-version and .python-versions files (#21529)
• Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#21496)
• Warn and continue when uv python list cannot query an interpreter (#21498)

Documentation

• Restore TOML syntax highlighting for exclude-newer examples (#21534)

Install uv 0.12.11

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.11/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.11/uv-installer.ps1 | iex"

Download uv 0.12.11

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-04.

Enhancements

• Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#21423)

Preview features

• Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#21455)
• Show terminal dependency cycles in uv tree --invert output (#21404)

Performance

• Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#21399)
• Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#21389)

Bug fixes

• Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#21454)
• Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#19571)
• Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#21450)
• Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#21395)
• Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#21453)

Install uv 0.12.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.ps1 | iex"

Download uv 0.12.10

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#21413, #21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
• Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

Install uv 0.12.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex"

Download uv 0.12.9

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-08-31.

Enhancements

• Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

• Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
• Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
• Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

• Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
• Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
• Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
• Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

• Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
• Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)
• Redact Azure shared access signature (sig) query parameters from displayed URLs (#21360)
• Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#21341)

Other changes

• Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#21346)

Install uv 0.12.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.8/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.8/uv-installer.ps1 | iex"

Download uv 0.12.8

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

• remove pyx specific features (#21182, #21183, #21184, #21185, #21186)

Install uv 0.12.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex"

Download uv 0.12.7

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
• Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#21002)
• Enable profile-guided optimization for Linux ARM64 release binaries (#21004)
• Speed up syncing projects with many activated conflict items by reusing their encoded representation (#21148)

Bug fixes

• Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#21294)
• Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#21275)
• Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#21224)
• Prevent TLS segfaults in riscv64 musl release binaries (#21158)
• Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#21181)
• Preserve version constraints from transitively referenced recursive extras (#21209)
• Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#21264)
• Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#21282)
• Do not misclassify package URLs ending in .py as local script paths (#21144)
• Use directory creation times consistently across libc implementations for directory cache-keys entries (#21137)
• Promote human-readable sizes to the next unit at rounding boundaries (#21136)

Other changes

• Add Python 3.15 release-candidate Docker images (#21293)
• Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#21258)

Install uv 0.12.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.6/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.6/uv-installer.ps1 | iex"

Download uv 0.12.6

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-08-14.

Python

• Add CPython 3.10.21, 3.11.16, and 3.12.14 (#21138)
• Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (#21134)

Enhancements

• Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (#21130)

Preview features

• Allow --index and --default-index to select configured package indexes by name with the index-by-name preview feature (#17455)
• Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (#21131)
• Fall back to logical file sizes when using cache-physical-space on filesystems that do not support physical-space accounting (#21133)

Bug fixes

• Resolve relative package index paths in PEP 723 scripts against the script directory (#21097)

Install uv 0.12.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.ps1 | iex"

Download uv 0.12.5

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-08-13.

Enhancements

• Prefer post-quantum key exchange and enable opt-in TLS diagnostics (#21054)
• Accept whitespace before versions in noncompliant wildcard comparisons such as Requires-Python: >= 3.5.* (#21012)
• Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (#20944)
• Omit source-span carets from diagnostics for empty PEP 508 requirements (#21094)

Preview features

• Add uv check --no-install-project and respect UV_NO_INSTALL_PROJECT to install dependencies without building or installing the project (#21085)
• Make the ty subprocess invoked by uv check honor uv's color and progress settings, including quiet mode (#21086)

Performance

• Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (#20804)
• Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (#21041)

Bug fixes

• Use windowed pythonw.exe launchers for virtual environments created from managed Python minor-version links (#19235)
• Allow uv lock to proceed when .venv is an unusable project environment (#21068)
• Respect fork-strategy when ordering forks created from environments or existing lockfile resolution-markers (#21000)
• Preserve consecutive wildcard Python minor-version exclusions such as !=3.11.*, !=3.12.* in uv.lock (#21045)
• Preserve inline comments on the final item in dependency arrays when uv add updates it (#21008)
• Recover from stale base-interpreter cache metadata when an existing virtual environment exposes a version mismatch (#21073)
• Prevent interpreter cache reuse across different PYTHONEXECUTABLE and __PYVENV_LAUNCHER__ overrides (#21075)
• Show standard styling, usage guidance, and line termination for invalid uv version --bump values (#21076)

Install uv 0.12.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.4/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.4/uv-installer.ps1 | iex"

Download uv 0.12.4

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-08-07.

Python

• Add CPython 3.13.15 (#20997)

Preview features

• Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#20992)
• Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#20991)
• Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#20990)

Performance

• Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#20989)
• Reuse compiled workspace exclusion patterns during workspace discovery (#20988)
• Speed up conflict-heavy resolutions by avoiding materialized range complements (#20982)
• Avoid slow procfs reads during Python interpreter discovery on Linux (#20987)

Documentation

• Add PEP 740 attestations to the GitHub Actions publishing example (#20986)
• Restrict the GitHub Actions publishing example to Python version tags (#20973)
• Correct --python-pin to --pin-python in the uv init --bare example (#20876)

Install uv 0.12.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.ps1 | iex"

Download uv 0.12.3

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-08-05.

Python

• Add CPython 3.15.0rc1 (#20948)
• Add CPython 3.14.7 (#20971)

Enhancements

• Ensure diagnostic hints end with a newline to prevent malformed terminal output (#20959)

Preview features

• Audit one or all installed tools with uv tool audit (#20921)
• Report physically reclaimed disk space during cache cleanup with the cache-physical-space preview feature (#20925)

Configuration

• Add UV_RUN_RLIMIT_NOFILE to set the open-file limit for commands launched by uv run (#20926)

Performance

• Speed up uv.lock parsing for wheel entries (#20881)
• Speed up uv.lock parsing for source distribution entries (#20882)
• Speed up filename extraction from distribution URLs (#20879)
• Reduce filesystem metadata lookups during bytecode compilation (#20928)
• Reuse file metadata when building source distributions (#20927)

Bug fixes

• Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions (#20963)
• Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested (#20930)

Documentation

• Separate build and publish jobs in the GitHub Actions publishing guide (#20946)
• Ensure the GitHub Actions publishing example waits for the build job to finish (#20957)
• Correct typos in the Docker integration guide (#20970)

Install uv 0.12.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.2/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.2/uv-installer.ps1 | iex"

Download uv 0.12.2

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-31.

Enhancements

• Add package-specific pre-release policies with --prerelease-package (#20837)
• Support local HTML files as flat indexes (#20802)
• Add Xonsh virtual environment activation scripts (activate.xsh) (#19740)
• Preserve filesystem paths passed to uv add --index when updating pyproject.toml (#20817)

Preview features

• Add automatic fixes to uv check with --fix (#20793)
• Avoid rejecting unchanged metadata-free lockfiles when workspace dependencies share direct sources (#20847)
• Honor direct URL constraints when validating metadata-free lockfiles (#20796)
• Ignore malformed PEP 723 scripts discovered during project checks (#20784)
• Use ty's native script exclusion in uv check (#20742)

Performance

• Parse canonical uv lockfiles directly, with a fallback for other valid TOML syntax (#20648)
• Accelerate SHA-256 hashing on non-Windows ARM64 platforms (#20805)

Bug fixes

• Flush shell startup file updates before uv tool update-shell and uv python update-shell exit (#20842)
• Make workspace-root dependency groups available to commands run from workspace members (#20840)
• Resolve --find-links paths in requirements files relative to the containing file (#20832)
• Respect configured indexes in uv tool list --outdated (#20770)

Documentation

• Document Astral GPU indexes in the PyTorch guide (#20785)
• Use consistent dependency-group argument descriptions throughout the CLI documentation (#20823)

Install uv 0.12.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-installer.ps1 | iex"

Download uv 0.12.1

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-28.

Since we released uv 0.11.0 in March, we've accumulated changes that improve correctness, safety, and compatibility with specifications, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution.

We expect most users to be able to upgrade without making changes.

There are no breaking changes to the configuration of the uv build backend. If your [build-system] table includes an upper bound on uv_build, update it to allow uv_build 0.12, e.g., uv_build>=0.11.32,<0.13.

Breaking changes

• Define build systems by default with uv init (#19197)

  Projects created with uv init now declare a build system and are packaged by default. This was the default project layout all the way back in v0.3, but we found that the use of the hatchling build system was confusing to newcomers and consequently dropped use of a build system by default in v0.4. Since then, we've created our own build system (uv_build) with tight integration with uv and are excited to restore the default to a best-practice project layout.

  Previously, uv init example created an unpackaged layout containing main.py and a pyproject.toml without a build system. The project could declare dependencies but was not itself installed into its virtual environment.

  Now, uv init example defines a [build-system] using uv_build, places application source code in src/example, and includes a [project.scripts] entry named example. Defining a build system allows the project to be imported from tests or other code, installed as a dependency, and run as a command:

  $ uv init example
  $ cd example
  $ uv run example
  Hello from example!

  Existing projects are unaffected. Use uv init --no-package example to create the previous unpackaged layout without a build system.

  See the project creation documentation for more details.

  This stabilizes the packaged-init preview feature.

• Reject unsupported source distribution and wheel archive formats (#18927)

  PEP 625 requires source distributions to use .tar.gz archives. Previously, uv also accepted legacy formats such as .tar.bz2 and .tar.xz. Those formats are now rejected, including when referenced by an existing lockfile. Legacy .zip source distributions remain supported for backwards compatibility.

  Wheels and other ZIP archives can no longer contain entries compressed with bzip2, LZMA, or XZ. Entries must use the stored, DEFLATE, or zstd compression methods.

  Removing support for uncommon compression methods reduces uv's compression dependencies and the attack surface exposed when processing untrusted packages.

  You cannot opt out of this behavior. If you depend on a legacy source distribution that uses an unsupported format, we recommend rebuilding it as a .tar.gz archive and regenerating any lockfile containing references to the legacy archive.

• Reject wheel files that could replace the Python interpreter (#20748, #20749)

  uv already rejected wheel entry points named python, but case variants such as Python were still accepted. On case-insensitive filesystems, including common macOS and Windows setups, these entry points could overwrite the virtual environment's interpreter.

  Wheels could also place interpreter files in their .data/scripts directory or in paths such as .data/data/bin/python, bypassing the entry-point check and replacing the interpreter during installation.

  uv now rejects case-insensitive variants of reserved interpreter names and wheel data files that would be installed over an interpreter. This includes names such as Python, python.py, and Python.exe, along with other reserved interpreter names and their versioned variants.

  You cannot opt out of these checks. Rename conflicting entry points or wheel data files and rebuild the affected wheel.

• Prefer stable releases before falling back to pre-releases (#19993)

  A dependency can introduce a pre-release requirement after resolution starts. uv previously required each package's pre-release eligibility to be known before resolution began: the default if-necessary-or-explicit mode allowed them for direct requirements that explicitly requested a pre-release, or for packages that only published pre-releases.

  This meant that a pre-release requirement discovered in a dependency's metadata, e.g., example>=2.0.0b1, would fail to resolve even when a compatible pre-release existed. To resolve it, you had to add that dependency as a direct requirement or allow pre-releases across your entire dependency graph.

  The default mode is now if-necessary. uv tries stable candidates first and falls back to pre-releases when no stable candidate satisfies the active constraints. Like pip, uv now supports pre-release requirements discovered transitively, but can select different versions than previous uv releases when both stable and pre-release candidates are available.

  You can opt out of automatic pre-release selection with --prerelease disallow. Alternatively, --prerelease allow considers pre-releases without first preferring stable releases, and --prerelease explicit only allows them for direct requirements that mention a pre-release.

  The old if-necessary-or-explicit mode distinguished between explicitly requested pre-releases and packages with no stable releases. That distinction is unnecessary now that if-necessary handles both cases, including transitive requirements. The old name remains available as an alias but is deprecated and will be removed in a future release.

• Respect --require-hashes directives in requirements.txt (#19336)

  Previously, uv pip install and uv pip sync warned about --require-hashes inside a requirements.txt file but still installed dependencies without checking their hashes. Now, the directive enables hash-checking mode, just as if --require-hashes had been passed on the command line.

  For example, this requirements file is no longer accepted because the requirement is neither pinned nor hashed:

  --require-hashes
  anyio
  

  You cannot opt out while the directive is present. Pin every requirement with == and provide its hash, or remove --require-hashes if hash checking is not intended.

• Reject MD5-only hashes in hash-checking mode (#20758)

  Previously, uv pip install --require-hashes and uv pip sync --require-hashes accepted requirements whose only available digest used MD5. MD5 is not collision-resistant, so relying on it undermined installations that require hash verification and differed from pip's behavior.

  Hash-checking mode now requires at least one secure digest for every requirement. For example, the following requirement is rejected unless a secure hash, such as SHA-256, is also supplied:

  anyio==4.0.0 --hash=md5:420d85e19168705cdf0223621b18831a
  

  A secure hash can be supplied directly on the requirement or in a matching constraints file. Ordinary hash verification without --require-hashes continues to support MD5.

  You cannot opt out while hash checking is required. Regenerate affected hashes with SHA-256 or another supported secure hash.

• Reject invalid pylock.toml files and artifacts (#20402, #20440, #20443)

  uv now validates additional requirements from the pylock.toml specification:

  • The packages array must be present. Previously, uv interpreted a missing array as an empty lockfile, so uv pip sync could uninstall an environment instead of rejecting malformed input. An explicitly empty packages = [] array remains valid.
  • Lockfile filenames must be pylock.toml or a single-name variant such as pylock.dev.toml. Names such as pylock..toml and pylock.foo.bar.toml are rejected.
  • If a wheel, source distribution, or other artifact declares a size, the downloaded or cached artifact must match. Previously, an incorrect size was accepted when the hash was correct. Sizes reported by package indexes remain advisory.

  You cannot opt out of these checks. Regenerate malformed lockfiles, rename invalid filenames, and either correct or remove an incorrect optional size value.

• Honor explicit certificate overrides even when no certificates can be loaded (#20741, #20767)

  Previously, uv ignored SSL_CERT_FILE or SSL_CERT_DIR values that pointed to missing or inaccessible paths, empty files or directories, or sources without valid certificates. Instead, it fell back to its default trust roots, potentially allowing HTTPS connections that the configured override was intended to reject.

  Now, any non-empty SSL_CERT_FILE or SSL_CERT_DIR value replaces uv's default certificate roots, even when no valid certificates can be loaded. In that case, HTTPS requests fail because no certificates are trusted. This applies to package downloads and remote scripts, including GitHub Gists.

  Fix or unset the certificate override. Unsetting it restores the default trust store; empty environment-variable values continue to be ignored.

• Support pip-compatible --cert handling in uv pip (#20418)

  The uv pip interface now accepts --cert <path>, e.g.:

  $ uv pip install --cert ./company-ca.pem example

  As in pip, the provided PEM bundle replaces all other certificate sources for that invocation, including system certificates and SSL_CERT_FILE or SSL_CERT_DIR. This change has no effect unless you pass --cert. Include the necessary certificate authorities in the bundle.

  --cert is only supported by uv pip commands; other uv commands continue to use their existing certificate configuration.

• Discover projects relative to the script passed to uv run (#20225)

  Previously, uv run project/script.py discovered its project from the current directory, even when the script belonged to another project. uv now starts project and workspace discovery from the script's directory instead.

  For example, running uv run other-project/script.py now uses other-project and its dependencies. This fixes scripts that previously failed because their own dependencies were not installed, but can select a different environment than before.

  You can opt out of script-relative discovery by selecting a project explicitly, e.g., uv run --project . other-project/script.py.

  This stabilizes the target-workspace-discovery preview feature.

• Require --force before clearing a directory that is not a virtual environment (#20225)

  uv venv --clear previously removed any existing target directory, even if it was not a virtual environment. uv emitted a warning but still deleted the directory and its contents. Now, uv refuses to clear directories that do not contain a virtual environment.

  You can opt out of this safety check by explicitly passing --force, e.g., uv venv --clear --force ./not-a-virtualenv.

  This stabilizes the venv-safe-clear preview feature.

• Reject --project when initializing a project (#20225)

  --project selects an existing project, so it is not meaningful when initializing a new one. Previously, uv init --project example warned and initialized example anyway; if a positional path was also provided, --project was ignored.

  This usage is now an error. Use uv init example to initialize a project at the requested path, or uv init --directory example to change the working directory first.

  This stabilizes the init-project-flag preview feature.

• Reject missing or invalid --project paths (#20225)

  uv previously warned when --project referred to a missing directory or a file other than pyproject.toml, but then attempted to continue. This could produce confusing errors later or run against an unintended project.

  Now, uv run --project missing python fails immediately instead of continuing. You cannot opt out of this behavior. Create the directory first or select an existing project. Passing --project path/to/pyproject.toml remains supported and selects the file's parent directory.

  This stabilizes the project-directory-must-exist preview feature.

• Skip distributions with non-normalized filenames when publishing (#20225)

  Distribution filenames must use normalized package names and versions. For example, a wheel for version 1.01.0 should be named example-1.1.0-py3-none-any.whl, not example-1.01.0-py3-none-any.whl.

  Previously, uv publish warned about non-normalized filenames but still attempted to upload them. It now skips the affected wheels and source distributions instead.

  You cannot opt out of this behavior. Rebuild distributions with normalized filenames before publishing.

  This stabilizes the publish-require-normalized preview feature.

• Classify Conda environments named base and root by their paths (#20225)

  Conda environments named base or root were previously assumed to be the base Conda environment, even when they were ordinary child environments. uv now recognizes child Conda environments named base or root based on their paths, as it already does for other names.

  You can opt out of automatic interpreter selection by requesting an interpreter explicitly with --python /path/to/python.

  This stabilizes the special-conda-env-names preview feature.

• Reject broken .venv symlinks during environment discovery (#20433)

  Previously, uv could ignore a broken .venv symlink and continue searching parent directories for another virtual environment. As a result, commands such as uv pip install could unexpectedly modify an unrelated ancestor environment.

  uv now stops at a broken .venv symlink and reports its exact path. Errors encountered while reading virtual environment metadata, including permission failures, are also reported immediately instead of being ignored.

  You cannot opt out of this behavior. Repair or remove the broken .venv symlink and correct any permissions that prevent uv from inspecting the environment.

• Reinstall matching installed Python patch versions instead of upgrading implicitly (#20659)

  Before Python upgrades were supported, uv python install 3.12 --reinstall doubled as a way to install the latest Python 3.12 patch release. Now that --upgrade is available, --reinstall reinstalls the matching patch releases that are already present.

  For example, if Python 3.12.6 and 3.12.7 are installed, uv python install 3.12 --reinstall reinstalls both versions instead of installing the latest available 3.12 release.

  You can recover the previous upgrade behavior with uv python install 3.12 --upgrade. Combine --upgrade --reinstall to reinstall only the latest patch.

• Require --upgrade-group to name an existing dependency group (#18957)

  Previously, uv lock --upgrade-group docs silently succeeded even if no docs dependency group existed. uv now validates the requested group against the project, its workspace members, and workspace-level dependency groups.

  You cannot opt out of this behavior. Correct the group name or add it to [dependency-groups]. Legacy tool.uv.dev-dependencies still satisfies --upgrade-group dev.

• Resolve relative indexes and find-links against --directory (#20740)

  The --directory option changes the directory in which uv operates. Previously, relative index and find-links paths supplied on the command line were still resolved against the original working directory.

  uv now resolves --index, --default-index, --index-url, --extra-index-url, and --find-links relative to the directory selected by --directory. For example:

  $ uv add --directory project --index ./packages example

  This now uses project/packages instead of ./packages in the original working directory. Absolute paths and indexes loaded from configuration files are unaffected.

  To preserve the previous target, pass an absolute path or adjust the relative path, e.g., --index ../packages.

• Preserve absolute paths provided to uv add (#18402)

  uv add previously converted every local dependency into a project-relative path, even when the original request used an absolute path or a literal file:// URL. It now preserves the form of the request in pyproject.toml and uv.lock:

  $ uv add ../library             # remains relative
  $ uv add /projects/library      # remains absolute

  Absolute paths make a project less portable. Use a relative path to avoid recording an absolute path. URLs containing expanded variables retain their existing relative-path behavior.

• Remove older PyPy distributions that are only available as bzip2 archives (#20423)

  Older PyPy patch releases that are only distributed as .tar.bz2 archives are no longer available through uv python install. These releases require unsupported bzip2 archives.

  The latest PyPy release for each supported Python minor version is available as a gzip-compressed archive and remains supported. For example, uv python list 3.10 --all-versions still includes the latest PyPy 3.10 release, but older bzip2-only patch releases are omitted.

  You cannot opt out of this behavior. Request a newer PyPy patch release instead.

• Omit excluded-package comments when annotations are disabled (#20085)

  uv pip compile --no-annotate suppresses comments describing the generated requirements file. Previously, a footer listing packages excluded with --unsafe-package was still included, even though annotations were disabled. That footer is now omitted.

  You can recover the footer by removing --no-annotate.

Stabilizations

• TOML 1.0-compatible source distributions (#20225)

  uv_build now writes a TOML 1.0-compatible pyproject.toml when building source distributions, allowing older Python build frontends to consume projects that use newer TOML syntax. The original project file remains available in the archive as pyproject.toml.orig.

  This stabilizes the toml-backwards-compatibility preview feature.

• Automatic open-file limit adjustment on Unix (#20225)

  On Linux and macOS, uv now attempts to raise the soft open-file limit at startup toward the hard limit, capped at 1,048,576 descriptors. The new limit also applies to subprocesses and reduces failures caused by running out of file descriptors. If the limit cannot be raised, uv continues running with the existing limit.

  This stabilizes the adjust-ulimit preview feature.

Preview features

• Allow uv upgrade to target multiple packages, upgrade all production dependencies, and exclude selected dependencies (#20338)

Bug fixes

• Include extras activated by dependency groups when evaluating conflicts (#20237)

Install uv 0.12.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.0/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.0/uv-installer.ps1 | iex"

Download uv 0.12.0

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-28.

Enhancements

• Abort panics in release builds for smaller uv binaries (#20271)
• Use .tar.gz archives for Pyodide installs (#20667)

Preview features

• Avoid checking any scripts in uv check unless --script is passed (#20676)
• Check locked tools for malware before cache reuse (#20301)
• Write and read package.metadata-free lockfiles (#20688, #20691, #20685, #20695)

Bug fixes

• Correctly split dependencies into production and optional markers (#20671)
• Fix discrepancies in argument parsing of exclude-newer (#20679)
• Cleanup managed Python temporary directory on error (#20752)

Install uv 0.11.33

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-installer.ps1 | iex"

Download uv 0.11.33

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-23.

Preview features

• Add --package and --all-packages selection to uv check (#20628)
• Allow uv upgrade to update multiple marker-specific declarations of the same package (#20335)
• Reject non-canonically formatted lockfiles in uv lock --check and commands using --locked (#20646)
• Regenerate non-canonically formatted lockfiles with uv lock --refresh (#20634)
• Include best-effort information about the active environment in uv workspace metadata by default (#20643)

Performance

• Skip dependency-group conflict expansion when no additional conflicts can be inferred (#20611)

Bug fixes

• Fork universal resolutions when Requires-Python is discovered only from distribution metadata (#20586)

Install uv 0.11.32

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"

Download uv 0.11.32

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-21.

Enhancements

• Allow workspace sources to reference members in another workspace by path (#18401)
• Support .venv files containing paths to centralized project environments (#20022)
• Update bundled Windows timezone data to IANA 2026c (#20554)

Preview features

• Add an index-specific hash-algorithm setting for lockfile generation (#20605)

Configuration

• Add audit.malware-check and audit.malware-check-url settings (#20587)

Performance

• Avoid quadratic work when deduplicating transitive conflicts (#20578)

Bug fixes

• Suggest --emit-build-options for unsupported uv pip compile --emit-options (#20582)
• Reject source distributions and wheels with mismatched package names (#20432)
• Avoid retrying TLS certificate verification failures (#16245)
• Avoid warnings about uv_build settings for in-tree build backends (#20153)

Install uv 0.11.31

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"

Download uv 0.11.31

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-20.

Python

• Add CPython 3.15.0b4 (#20519)

Preview features

• Allow uv workspace metadata --sync to target the active virtual environment with --active (#20500)
• Reuse centralized project environments when workspaces are accessed through symlinks (#20436)

Performance

• Skip resolver candidates whose files are all excluded by exclude-newer (#20460)
• Limit parallel cache reads to reduce resolver scheduling and allocation overhead (#20427)
• Accelerate lockfile serialization with toml_writer (#20450)
• Compact cached Simple API distribution metadata and hashes (#20463, #20483)
• Decode stale cache entries in a single blocking task (#20486)
• Decode cached payloads outside resolver workers (#20464)
• Cache resolver Python requirement markers (#20461)
• Reuse resolver fork markers while recording preferences (#20462)

Bug fixes

• Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall (#20429)
• Preserve literal extends-environment paths in pyvenv.cfg on Unix (#20466)

Documentation

• Add a contribution guide (#20511, #20552)

Install uv 0.11.30

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.ps1 | iex"

Download uv 0.11.30

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-15.

Python

• Use gzip-compressed artifacts for PyPy downloads (#20265)

Enhancements

• Add JSON output to uv tree (#19978)
• Add CUDA 13.2 as a supported PyTorch backend (#20267)
• Prefer local artifacts over URLs when installing from pylock.toml (#20393)
• Clarify diagnostics for unsatisfiable direct requirement ranges (#20227)
• Include the selected project name in missing-extra errors (#20358)

Preview features

• Preserve extras and dependency-group conflict context when selecting locked project tools (#20078)
• Split OSV audit queries that exceed the service's 1,000-package limit (#20398)
• Apply OSV fixed-version information only to the matching package and ecosystem (#20399)
• Skip the virtualenv distutils monkeypatch on Python 3.10 and later (#20222)
• Report invalid uv audit --service-url values instead of panicking (#20374)
• Include preview settings in the published SchemaStore schema (#20304)

Performance

• Reduce resolver work by widening selected versions across ranges without other known candidates (#20115)
• Defer client and build setup for no-op uv sync operations (#20364)
• Reuse workspace discovery during frozen syncs (#20363)
• Reuse workspace discovery after resolving settings (#20356)
• Reuse workspace discovery in uv tree, uv export, uv format, and uv audit (#20359)
• Avoid cache and interpreter setup when reading a project version (#20360)

Bug fixes

• Reject duplicate active package entries in pylock.toml (#20391)
• Preserve direct-archive hashes in uv pip freeze output (#20395)
• Explain conflicting root requirements instead of displaying an empty version range (#20228)
• Prevent build-backend data paths from escaping the project or bypassing wheel exclusions (#20397)
• Reject PEP 517 backend paths outside the source tree, including paths that escape through symlinks (#20387)
• Redact credentials from failed Git fetch commands (#20401)
• Fix exclusive post-release range ordering to match PEP 440 (#20268)
• Canonicalize equivalent PEP 440 ranges during dependency resolution (#20182)
• Honor Python version pins when initializing scripts (#20404)
• Respect package-scoped source filtering for scripts (#20389)
• Report existing environment incompatibilities when uv pip install --strict has nothing to install (#20388)
• Continue scanning platlib when purelib is missing (#20405)
• Handle versionless .egg-info files as legacy package metadata (#20403)
• Make repeated locking idempotent for impossible cross-variable platform markers (#20369)
• Report invalid cloud credential endpoint URLs instead of panicking (#20372)
• Report invalid pylock.toml artifact URLs instead of panicking (#20373)
• Report non-UTF-8 virtual environment paths instead of panicking while generating activation scripts (#20375)
• Return an unsupported-operation error from unimplemented build-backend requirement hooks (#20376)

Documentation

• Clarify --no-build behavior for editable requirements (#20234)
• Document uv's threat model (#20236)
• Reduce the number of badges in the README (#11257)

Install uv 0.11.29

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-installer.ps1 | iex"

Download uv 0.11.29

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

• Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

• Improve trace logs for unexpected error chains (#20220)
• Move lockfile update guidance to a hint (#20219)
• Preserve indentation for multiline error causes (#20156)
• Render user errors with their cause chains (#20217)
• Route final command errors through the printer to respect -q and -qq (#20163)
• Use standard rendering for uv build errors (#20159)
• Use standard rendering for tool requirement errors (#20160)

Performance

• Only compile bytecode for installed distributions in uv pip install (#19914)
• Avoid allocating URL-safe Git revisions (#20194)
• Avoid allocating canonical Python request strings (#20193)
• Avoid allocating custom Astral mirror URLs (#20204)
• Avoid allocating expanded compatibility tags (#20190)
• Avoid allocating shell strings that need no escaping (#20196)
• Avoid allocating static ABI descriptions (#20201)
• Avoid allocating static Windows executable names (#20200)
• Avoid allocating static dependency table names (#20199)
• Avoid allocating static platform triple components (#20195)
• Avoid allocating static resolver report labels (#20198)
• Avoid allocating static unavailable-version messages (#20197)
• Avoid allocating unchanged Python download architectures (#20202)
• Avoid allocating unchanged paths during case normalization (#20203)
• Avoid allocations when expanding group conflicts (#20211)
• Avoid allocations when formatting requirements (#20206)
• Avoid cloning credential lookup services (#20210)
• Avoid cloning dry-run distributions (#20209)
• Avoid cloning owned dependency metadata (#20212)
• Avoid redundant direct URL clones (#20207)
• Create metadata version errors lazily (#20205)
• Optimize expanded tag compatibility checks (#20171)
• Optimize parsing of single-digit three-part versions (#20118)

Bug fixes

• Avoid overflow when computing HTTP cache age (#20178)
• Respect --upgrade when upgrade-package is configured (#19955)
• Support uv tree in dependency-group-only projects (#20167)
• Treat cache entries as stale at exact expiration (#20183)

Install uv 0.11.28

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-installer.ps1 | iex"

Download uv 0.11.28

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-07-06.

Enhancements

• Continue on ignored errors when fetching wheel metadata (#12255)
• Use caching for --python-downloads-json-url (#16749)

Preview features

• Discover extensionless shebang scripts in uv workspace list --scripts (#20099)

Performance

• Avoid full site-packages scans for direct reinstalls (#20119)
• Avoid redundant pyproject parsing (#20076)
• Cache default dependency markers when reading locks (#20125)
• Enable SIMD-accelerated TOML parsing (#20079)
• Intern requires-python specifiers in Simple API parsing (#20104)
• Read cache entries into exact-sized buffers (#20120)
• Reduce VersionSpecifiers parsing allocations (#20105)
• Reduce site-packages scan allocation overhead (#20087)
• Reuse package names when parsing wheel filenames (#20110)
• Sort Simple API files after grouping (#20112)

Bug fixes

• Always emit packages table for pylock.toml (#20145)
• Avoid blank line for empty uv pip tree (#20062)
• Encode hashes in file paths (#19807)
• Error on a registry uv.lock package without a version instead of panicking (#19855)
• Preserve conditional extra markers in exports (#20148)
• Skip the ambiguous authority check for file transport VCS URLs (#20086)
• Sync index format when uv add --index updates an existing index URL (#19818)

Other changes

• Re-add pub APIs used in Pixi (#20074)
• Update Rust toolchain to 1.96.1 (#20103)

Install uv 0.11.27

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-installer.ps1 | iex"

Download uv 0.11.27

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-06-30.

Performance

• Adapt uv to IDs-only PubGrub dependencies (#20048)
• Avoid allocations in ForkMap::contains (#20023)
• Reuse resolver work across PubGrub iterations (#20020)
• Speed up candidate selection for disjoint ranges (#20026)

Bug fixes

• Warn when the build cache is inside the source directory (#20056)

Install uv 0.11.26

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-installer.ps1 | iex"

Download uv 0.11.26

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-06-26.

Security

This release updates our tar library, astral-tokio-tar, to v0.6.3, which includes over 20 changes that harden our tar handling against parser differentials. uv may reject source distributions with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Enhancements

• Add a full "lockfile" to tool receipts (#18937)
• Allow scoped overrides to add dependencies (#19974)
• Avoid writing redundant lockfile markers with tool.uv.environments (#19933)
• Factor supported environments out of lockfile markers (#19969)
• Recommend our own build backend in the build frontend (#19994)
• Reject wheels with multiple .dist-info directories (#19986)
• Simplify dependency markers under parent reachability (#19971)
• Support scoped dependency exclusions (#19977)
• Support scoped dependency overrides (#19970)
• Explain why files are skipped in registry index parsing (#19983)

Preview features

• Add uv workspace list --scripts (#20009)
• Support centralised environments in uv venv (#19912)
• Use locked ty versions in uv check (#19884)
• Add centralized storage of project environments (#18214)
• Verify lockfile hashes before reusing a cached ty in uv check (#19995)
• Use locked dependency selection for uv check --script (#19989)

Bug fixes

• Preserve standalone markers in workspace metadata (#20011)
• Reject uv build if the cache dir is enclosed (#19991)

Install uv 0.11.25

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.ps1 | iex"

Download uv 0.11.25

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-06-23.

Python

• Add CPython 3.15.0b3 (#19964)

Preview features

• Make project environments relocatable under preview (#19965)

Performance

• Use a compact index for lazy version maps (#19959)

Bug fixes

• Allow disabling exclude-newer (#19934)
• Avoid archive id collisions (#19949)
• Reapply "Fix transparent Python upgrades in project environments" (#19928)
• Clean up partial tool entrypoint installs (#19966)
• Fix relocatable activate.fish and broaden Fish version support (#19856)

Install uv 0.11.24

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-installer.ps1 | iex"

Download uv 0.11.24

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-06-19.

Bug fixes

• Revert "Fix transparent Python upgrades in project environments" to mitigate unintended breakage in pre-commit-uv (#19925)
• Restore old behavior where workspace members "hidden" by an intermediate pyproject.toml would be treated as standalone projects (#19926)

Install uv 0.11.23

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-installer.ps1 | iex"

Download uv 0.11.23

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Release Notes

Released on 2026-06-18.

Enhancements

• Publish wheels before sdists in uv publish (#19831)
• Add TY and RUFF env vars for providing paths for binaries used by uv format and uv check (#19821)

Preview features

• Allow configuring preview features in uv.toml and pyproject.toml (#18437)
• Update the lockfile during uv check --no-sync (#19909)
• Add --script to uv check and uv metadata (#19860)
• Report workspace-exclusive dependency groups in workspace metadata (#19862)
• Support SARIF as a uv audit output (#19872)

Performance

• Use a more deadlock-resistant concurrent hashmap in the resolver (#19532)

Bug fixes

• Update string marker ordering semantics to match upstream clarified rules (#19808)
• Reject extras that have the same normalized name (#19871)
• Reject dependency group include-group entries that have additional fields (#19866)
• Reject invalid UTF-8 URL credentials (#19814)
• Validate that PEP 517 backend-paths exist when building sdists (#19834)
• Validate that pylock.toml files do not have an unsupported a lock-version (#19869)
• Validate that the environment satisfies the packages.requires-python of a pylock.toml (#19868)
• Allow uv to be recursively invoked by PEP 517 build hooks (#19879)
• Allow empty credentials.toml files (#19815)
• Fix transparent Python upgrades in project environments (#19890)
• Handle non-file editable URLs in uv pip list (#19867)
• Fix incorrect output from uv tree --invert (#19910)
• Fix environment locking of uv venv in a project (#19837)
• Fix handling of workspace-exclusive dependency groups in uv tree (#19905)

Documentation

• Archive the 0.10.x changelog (#19813)

Other changes

• Mark more tests as requiring network for vendors that need to run tests offline (#19819)

Install uv 0.11.22

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-installer.ps1 | iex"

Download uv 0.11.22