ReleaseBytes
python uv Releases · · 0.12.16

uv 0.12.16 Release: Enhanced Python Package Management & Security

sdkazurepreviewengineer
feature patch

Astral-sh has released uv 0.12.16, introducing support for new Pyodide versions and significant enhancements to package integrity verification. This update allows verification of downloaded wheels and source distributions against package index hashes, and enables hash inclusion for build dependencies. Additionally, it brings several preview features, including improved `uv check` functionality and better handling of index settings, alongside critical bug fixes for URL redaction and error handling.

  • →Add Pyodide 314.0.7, 0.29.5, and 0.27.8
  • →Honor configured and command-line index settings, including credentials, in uv upgrade
  • →Allow uv check to run in projects that are not managed by uv and outside workspaces
  • →Respect --python and UV_PYTHON when selecting the Python version for uv check
  • →Verify downloaded wheels and source distributions against hashes supplied by package indexes
Features (5) ›
  • Add Pyodide 314.0.7, 0.29.5, and 0.27.8
    #21741

  • Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation

    #21163
  • Honor configured and command-line index settings, including credentials, in uv upgrade
    #21776
  • Allow uv check to run in projects that are not managed by uv and outside workspaces
    #21777
  • Respect --python and UV_PYTHON when selecting the Python version for uv check
    #21744
Enhancements (4) ›
  • Verify downloaded wheels and source distributions against hashes supplied by package indexes
    #21562
  • Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies
    #21467
  • Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets
    #21766
  • Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports
    #21779
Fixes (7) ›
  • Redact Azure shared access signatures from displayed and logged URLs
    #21755
  • Check archive sizes from pylock.toml before reusing cached distributions
    #21609
  • Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths
    #20631
  • Use the bundled uv_build backend only when its version matches active version pins
    #21742
  • Handle malformed index URLs without panicking when credentials are configured
    #21784
  • Report a configuration error instead of panicking for proxy URLs without a host
    #21781
  • Return a credential-redacted error instead of panicking when a URL cannot be converted to a path
    #21783
Read the original announcement →

https://github.com/astral-sh/uv/releases/tag/0.12.16

Related releases