ReleaseBytes
python uv Releases · · 0.12.9

astral-sh/uv 0.12.9 Released with CPython 3.15.0rc2 Support

sdksecuritygaengineermedia
security feature patch

uv version 0.12.9 is now available, bringing compatibility with CPython 3.15.0rc2 and several significant enhancements. This release improves performance for cold wheel installs by optimizing ZIP archive extraction and enhances usability with new flags to disable lock modes and clearer error reporting. It also addresses multiple security-related bug fixes, including a potential memory-safety issue, sensitive header removal during redirects, and redaction of secrets in retry diagnostics. These updates benefit Python developers by providing a more secure, faster, and more robust package management experience.

  • →Add CPython 3.15.0rc2 (#21413, #21415)
  • →Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation
  • →Report the exact command-line lock-mode flag in warnings and errors
  • →Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files
  • →Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels
Features (1) ›
  • Add CPython 3.15.0rc2 (#21413, #21415)
Enhancements (3) ›
  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation
    #21408
  • Report the exact command-line lock-mode flag in warnings and errors
    #21402
  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files
    #21372
Fixes (5) ›
  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels
    #21401
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes
    #21382
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors
    #21381
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values
    #21396
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel
    #21400
Read the original announcement →

https://github.com/astral-sh/uv/releases/tag/0.12.9

Related releases