ReleaseBytes
python uv Releases · · 0.12.0

uv 0.12.0 Enhances Python Dependency Management with Stricter Hash Checking and Project Discovery

sdkpreviewdeprecationengineer
breaking deprecation feature patch

uv 0.12.0 introduces several changes to improve correctness, safety, and compatibility for Python dependency management, some of which are breaking for specific workflows. Key updates include stricter enforcement of hash-checking directives in `requirements.txt` and rejection of MD5-only hashes for verification. The release also stabilizes preview features like script-relative project discovery and safe virtual environment clearing, while deprecating the old `if-necessary-or-explicit` pre-release mode. These changes primarily affect developers using `uv` for package installation and environment management, requiring updates to `uv_build` bounds or hash configurations for certain setups.

  • →Define build systems by default with uv init
  • →Reject unsupported source distribution and wheel archive formats
  • →Reject wheel files that could replace the Python interpreter (#20748, #20749)
  • →Prefer stable releases before falling back to pre-releases
  • →Respect --require-hashes directives in requirements.txt
Breaking changes (25) ›
  • Define build systems by default with uv init
    #19197
  • Reject unsupported source distribution and wheel archive formats
    #18927
  • Reject wheel files that could replace the Python interpreter (#20748, #20749)
  • Prefer stable releases before falling back to pre-releases
    #19993
  • Respect --require-hashes directives in requirements.txt
    #19336
  • Reject MD5-only hashes in hash-checking mode
    #20758
  • Reject invalid pylock.toml files and artifacts (#20402, #20440, #20443)

  • The packages array must be present. Previously, uv interpreted a missing array as an empty lockfile, so uv pip sync could uninstall an environment instead of rejecting malformed input. An explicitly empty packages = [] array remains valid

  • Lockfile filenames must be pylock.toml or a single-name variant such as pylock.dev.toml. Names such as pylock..toml and pylock.foo.bar.toml are rejected

  • If a wheel, source distribution, or other artifact declares a size, the downloaded or cached artifact must match. Previously, an incorrect size was accepted when the hash was correct. Sizes reported by package indexes remain advisory

  • Honor explicit certificate overrides even when no certificates can be loaded (#20741, #20767)
  • Support pip-compatible --cert handling in uv pip
    #20418
  • Discover projects relative to the script passed to uv run
    #20225
  • Require --force before clearing a directory that is not a virtual environment
    #20225
  • Reject --project when initializing a project
    #20225
  • Reject missing or invalid --project paths
    #20225
  • Skip distributions with non-normalized filenames when publishing
    #20225
  • Classify Conda environments named base and root by their paths
    #20225
  • Reject broken .venv symlinks during environment discovery
    #20433
  • Reinstall matching installed Python patch versions instead of upgrading implicitly
    #20659
  • Require --upgrade-group to name an existing dependency group
    #18957
  • Resolve relative indexes and find-links against --directory
    #20740
  • Preserve absolute paths provided to uv add
    #18402
  • Remove older PyPy distributions that are only available as bzip2 archives
    #20423
  • Omit excluded-package comments when annotations are disabled
    #20085
Features (1) ›
  • Allow uv upgrade to target multiple packages, upgrade all production dependencies, and exclude selected dependencies
    #20338
Fixes (1) ›
  • Include extras activated by dependency groups when evaluating conflicts
    #20237
Read the original announcement →

https://github.com/astral-sh/uv/releases/tag/0.12.0

Related releases