Update patch-updates - #268

v3.14.8

Compare Source

v0.12.24

Compare Source

Release Notes

Released on 2026-10-08.

Enhancements

• Remove orphaned temporary build environments with uv cache prune (#​22171)
• Accept PEP 508 marker operators directly before grouped expressions (#​22309)
• Reject malformed requirements-file options instead of partially parsing or ignoring them (#​22317)
• Show underlying filesystem and registry errors when managed Python uninstallation fails (#​22362)
• Identify the invalid source URL in Python mirror errors (#​22364)

Preview features

• Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#​22292)

Configuration

• Support custom installation mirrors for GraalPy (#​22269)
• Support custom installation mirrors for Pyodide (#​22271)
• Allow UV_NO_CACHE=false to override no-cache = true in configuration (#​22324)
• Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#​22144)

Performance

• Speed up later commands after creating an environment by warming its interpreter cache (#​21304)
• Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#​22246)
• Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#​22203)
• Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support (#​22242)
• Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (#​22144)
• Reduce Python download error formatting code size by sharing its formatter (#​22141)

Bug fixes

• Verify supplied hashes even when hash presence is disabled with --no-require-hashes or require-hashes = false (#​22369)
• Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (#​22360)
• Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (#​22237)
• Exclude optional dependencies from exports when their extras are activated only in incompatible environments (#​22234)
• Give explicit uv publish --trusted-publishing values precedence over configuration (#​22279)
• Allow UV_OFFLINE=false to override offline = true in configuration (#​22283)
• Allow UV_SYSTEM_CERTS=false to override system-certs = true in configuration (#​22291)
• Allow uv auth login over IPv6 loopback addresses (#​22306)
• Resolve GitHub dependencies whose Git references contain # or % characters (#​22281)
• Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (#​22322)
• Preserve JSON output from uv version and uv self version with a single --quiet flag (#​22280)
• Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (#​22284)
• Restore wheel incompatibility hints when WHEEL metadata contains multiple expanded Tag: rows (#​22235)
• Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (#​22302)
• Prevent workspace-cache assertion failures after modifying a project at the workspace root (#​22236)
• Hide the ignored --keyring-provider option from uv auth help (#​19520)
• Report HTTP client setup failures directly when resolving unnamed uv tool requirements (#​22320)

Documentation

• Update Docker and AWS Lambda examples to cache dependency layers using frozen lockfiles without project manifests (#​22172)
• Fix stale links and descriptions in Rust crate documentation (#​22311, #​22361)
• Fix a typo in the required-environments documentation (#​22238)

Install uv 0.12.24

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.ps1 | iex"

Download uv 0.12.24

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.12.23

Compare Source

Release Notes

Released on 2026-10-03.

Python

• Add CPython 3.15.0rc3 (#​22164)

Preview features

• Sync from uv.lock without a workspace manifest using uv sync --frozen with frozen-lockfile (#​22018)
• Export from uv.lock without a workspace manifest using uv export --frozen with frozen-lockfile (#​22007)
• Inspect dependency trees from uv.lock without a workspace manifest using uv tree --frozen with frozen-lockfile (#​22016)
• Inspect workspace metadata and optionally sync its environment from uv.lock without a workspace manifest using uv workspace metadata --frozen with frozen-lockfile (#​22017, #​22018)

Bug fixes

• Reject alternate sources for workspace members across conflicting dependency selections, avoiding lockfiles that cannot be installed (#​22153)
• Allow x86-64 Python interpreters running under emulation on Windows ARM64 to install compatible win_amd64 wheels instead of building from source (#​22099)

Install uv 0.12.23

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.23/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.23/uv-installer.ps1 | iex"

Download uv 0.12.23

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.12.22

Compare Source

Release Notes

Released on 2026-10-01.

Python

• Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (#​22147)

Enhancements

• Accept uppercase release suffixes in wheel platform tags (#​22113)
• Record workspace-member default groups in lockfiles (#​22010, #​22103)
• Record workspace-member dependency-group Python requirements in lockfiles (#​22044, #​22103)
• Record default groups for non-project workspace roots in lockfiles (#​22104)
• Record dependency-group Python requirements for non-project workspace roots in lockfiles (#​22104)
• Format URLs and paths consistently in CLI messages (#​21937)
• Hide the unsupported --offline option from uv publish help (#​22124)

Preview features

• Honor --no-default-groups in uv audit (#​22090)
• Report a clear error when uv audit or uv tool audit runs offline and hide the unsupported option from help (#​22114)

Configuration

• Add UV_PYTHON_ARCH to select an interpreter architecture independently of its Python version (#​22098)

Performance

• Reduce uv's binary size by compressing embedded Python download metadata (#​22126)

Bug fixes

• Verify unchanged requirements against existing lockfile hashes when relocking (#​22083)
• Honor dependency-group Python requirements at non-project workspace roots (#​22101)
• Use each selected workspace member's recorded default groups during frozen sync (#​22015)
• Avoid false entry-point warnings for required workspace members (#​22112)

Other changes

• Raise the minimum supported Rust version for building uv to 1.97 and update the toolchain to Rust 1.99 (#​22121)

Install uv 0.12.22

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.ps1 | iex"

Download uv 0.12.22

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.12.21

Compare Source

Release Notes

Released on 2026-09-29.

Python

• Update CPython to use OpenSSL 3.5.9 (#​22076)

Enhancements

• Omit empty [manifest] tables from lockfiles that contain only manifest subtables (#​22070)

Preview features

• Omit redundant runtime constraints from uv.lock, including those involving pre-releases, with the resolution-inputs preview feature (#​22004, #​22068)

Bug fixes

• Prevent uv python pin --rm from removing a global .python-versions file without --global (#​21992)
• Fix installed-package checks incorrectly reporting post-releases as incompatible with exclusive lower bounds on pre-releases (#​22049)

Install uv 0.12.21

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.21/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.21/uv-installer.ps1 | iex"

Download uv 0.12.21

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.12.20

Compare Source

Release Notes

Released on 2026-09-28.

Enhancements

• Reuse lockfiles when dependency declarations are semantically equivalent (#​21951)
• Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#​21990)

Preview features

• Write normalized requirement declarations with the lockfile-normalization preview feature (#​21951)
• Honor synthetic default groups when installing or syncing from pylock.toml (#​22003)
• Resolve local paths in exported pylock.toml files relative to the output file (#​22042)
• Install each package only once when repeated tool-install-locks requirements resolve to the same package (#​22000)
• Reuse lock-without-metadata lockfiles for conflicting groups with distinct base and extra requirement specifiers (#​22055)
• Use consistent root-package paths in uv workspace metadata and uv tree --format json output (#​22050)

Configuration

• Continue searching XDG_CONFIG_DIRS after empty entries (#​21987)

Performance

• Restore the previous HTTP cache-write scheduling while investigating severe cache-revalidation stalls on ext4 filesystems (#​22051)

Bug fixes

• Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#​21996)
• Allow metadata builds for first-party workspace projects under --no-build (#​21988)
• Honor project exclusion flags with --all-packages, including --no-install-project and --no-emit-project (#​21994)
• Restore pyproject.toml if uv upgrade fails or is interrupted (#​21983)
• Generate working Nushell activation scripts for relocatable virtual environments (#​21979)
• Prevent commands from running and changing state after displaying --show-settings (#​21989)
• Treat UTF-16 requirements files containing only a byte-order mark as empty (#​21991)
• Ignore unrecognized managed-Python implementation directories during uv python list and uv python upgrade instead of panicking (#​22033)
• Avoid panics and incorrect rewriting when managed Python sysconfig paths merely start with /install (#​22036)
• Report whitespace-only non-ASCII requirements as invalid instead of panicking (#​22035)
• Avoid a resolver panic when trace logging an always-false constraint (#​22034)

Install uv 0.12.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.20/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.20/uv-installer.ps1 | iex"

Download uv 0.12.20

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.12.19

Compare Source

Release Notes

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#​21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#​21847)

Enhancements

• Format upload URLs with backticks in uv publish errors (#​21934)

Preview features

• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#​21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#​21913)

Bug fixes

• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#​21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#​21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#​21891)
• Preserve always-false python_version markers when parsing their serialized form (#​21939)

Rust API

• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#​21965)

Documentation

• Make individual preview-feature reference entries linkable by name (#​21950)

Install uv 0.12.19

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"

Download uv 0.12.19

❗ Important

✂ PR body was truncated to here.