ReleaseBytes
python uv Releases · · 0.12.18

uv 0.12.18: Security Fix for Windows Path Traversal, Pip Enhancements

sdkinfrapreviewengineer
security feature patch

uv version 0.12.18 has been released, including a security fix for a path traversal vulnerability (GHSA-2cv4-cqwr-gwf7) affecting Windows during wheel installation. This update introduces `--output-format json` for `uv pip install` and `uv pip sync`, along with a new `--check` flag to report planned changes without modifying the environment. The release also delivers general enhancements, performance improvements, and bug fixes across the tool. Users on Windows are advised to update to mitigate the path traversal risk.

  • →Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check
  • →Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment
  • →Identify failures from get_requires_for_build_* hooks correctly in build errors
  • →Speed up uv_build editable wheel creation by omitting compression from temporary wheels
  • →Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
Features (1) ›

  • Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out

    #21880
Enhancements (4) ›
  • Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check
    #21893
  • Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment
    #21844
  • Identify failures from get_requires_for_build_* hooks correctly in build errors
    #21881
  • Speed up uv_build editable wheel creation by omitting compression from temporary wheels
    #21918
Fixes (7) ›

  • Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)

  • Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
  • Use configured dependency-metadata when checking whether installed requirements are satisfied
    #21843
  • Reject archive entries that normalize to absolute Windows paths
    #21923
  • Recognize distribution filenames and archive extensions when URL fragments contain ?
    #21920
  • Generate correctly lowercased platform tags for BSD and Haiku releases
    #21853
  • Avoid rebuilding a Windows relative path into an absolute form
    #21923
Read the original announcement →

https://github.com/astral-sh/uv/releases/tag/0.12.18

Related releases