ReleaseBytes
python uv Releases · · 0.12.0

uv 0.12.0 improves dependency resolution, hash checking, and environment management

sdkpreviewdeprecationengineer
breaking patch

The uv 0.12.0 release introduces significant improvements to dependency resolution, including a new default for handling pre-releases, making it more robust and aligned with pip's behavior. It also enhances security and correctness by enforcing stricter hash checking and validating lockfile formats. These changes primarily affect users managing Python dependencies, with most users expected to upgrade seamlessly, though some workflows might require adjustments. The release also stabilizes preview features related to project discovery and safe environment clearing.

  • →Define build systems by default with uv init
  • →Reject unsupported source distribution and wheel archive formats
  • →Reject wheel files that could replace the Python interpreter (#20748, #20749)
  • →Prefer stable releases before falling back to pre-releases
  • →Respect --require-hashes directives in requirements.txt
Breaking changes (25) ›
  • Define build systems by default with uv init
    #19197
  • Reject unsupported source distribution and wheel archive formats
    #18927
  • Reject wheel files that could replace the Python interpreter (#20748, #20749)
  • Prefer stable releases before falling back to pre-releases
    #19993
  • Respect --require-hashes directives in requirements.txt
    #19336
  • Reject MD5-only hashes in hash-checking mode
    #20758
  • Reject invalid pylock.toml files and artifacts (#20402, #20440, #20443)

  • The packages array must be present. Previously, uv interpreted a missing array as an empty lockfile, so uv pip sync could uninstall an environment instead of rejecting malformed input. An explicitly empty packages = [] array remains valid

  • Lockfile filenames must be pylock.toml or a single-name variant such as pylock.dev.toml. Names such as pylock..toml and pylock.foo.bar.toml are rejected

  • If a wheel, source distribution, or other artifact declares a size, the downloaded or cached artifact must match. Previously, an incorrect size was accepted when the hash was correct. Sizes reported by package indexes remain advisory

  • Honor explicit certificate overrides even when no certificates can be loaded (#20741, #20767)
  • Support pip-compatible --cert handling in uv pip
    #20418
  • Discover projects relative to the script passed to uv run
    #20225
  • Require --force before clearing a directory that is not a virtual environment
    #20225
  • Reject --project when initializing a project
    #20225
  • Reject missing or invalid --project paths
    #20225
  • Skip distributions with non-normalized filenames when publishing
    #20225
  • Classify Conda environments named base and root by their paths
    #20225
  • Reject broken .venv symlinks during environment discovery
    #20433
  • Reinstall matching installed Python patch versions instead of upgrading implicitly
    #20659
  • Require --upgrade-group to name an existing dependency group
    #18957
  • Resolve relative indexes and find-links against --directory
    #20740
  • Preserve absolute paths provided to uv add
    #18402
  • Remove older PyPy distributions that are only available as bzip2 archives
    #20423
  • Omit excluded-package comments when annotations are disabled
    #20085
Fixes (1) ›
  • Include extras activated by dependency groups when evaluating conflicts
    #20237
Read the original announcement →

https://github.com/astral-sh/uv/releases/tag/0.12.0

Related releases