pypi / uv
uv
What changed in uv 0.9 to 0.13, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
12 breaking7 security3 new APIs and options5 performance11 behavior and defaults4 tooling32 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli inituv 0.1341 changes
Breaking changes 11
Ignores Requires-Python upper bounds, consistent with resolution.
Each option value is now treated as a single path, including quoted paths containing spaces; repeat the option to provide multiple files.
Each option value is now treated as a single path, including quoted paths containing spaces; repeat the option to provide multiple files.
Each option value is now treated as a single path, including quoted paths containing spaces; repeat the option to provide multiple files.
Each option value is now treated as a single path, including quoted paths containing spaces; repeat the option to provide multiple files.
Python 3.15 is now the default stable version for downloads when no version is requested or pinned; existing compatible installations continue to be used.
uv now honors this directive in constraints files included with -c and requires hashes for all requirements in the installation.
uv now uses tar-codec by default to extract archives, build source distributions with uv_build, and read metadata for uv publish; stricter validation may reject some archives.
The command now rejects output directories containing a build source, including through symlinks, before clearing output.
uv uses tar-codec for tar archives by default, applying stricter validation; set this variable to 1 to opt out.
On Windows ARM64, uv now prefers native ARM64 interpreters; set this variable to x86_64 to opt out.
New APIs and options 1
This preview option requires hashes for build dependencies, including transitive dependencies.
Performance 4
Reduces overhead when parsing package metadata.
Simple API parsing is faster.
Reduces the size of the uv binary.
Many cache entry formats changed to improve performance; uv may download or rebuild dependencies after upgrading, while multiple uv versions can still safely share a cache directory.
Behavior and default changes 8
Supports Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable.
Resolution errors now report missing trusted hashes.
Ignores Requires-Python upper bounds, consistent with resolution.
Enables preliminary parsing of PEP 825 variant labels in wheel filenames.
Space-separated lists remain supported in this environment variable despite the changed handling of requirement-file option values.
Space-separated lists remain supported in this environment variable despite the changed handling of requirement-file option values.
Space-separated lists remain supported in this environment variable despite the changed handling of requirement-file option values.
Space-separated lists remain supported in this environment variable despite the changed handling of requirement-file option values.
Tooling 3
Adds support for CPython 3.16.0a1.
Can upgrade installed tools when tool-install-locks is enabled.
If the [build-system] table has an upper bound on uv_build, update it to allow uv_build 0.13.
Fixes and other changes 14
Environments with installed Git dependencies pinned to full commit hashes are reused without resolving again.
Concurrent readers can no longer observe partially written lockfiles.
Concurrent readers can no longer observe partially written managed Python sysconfig files.
Concurrent commands reaching the same environment through real and symlinked paths are serialized.
Concurrent readers can no longer observe partially written Python version files.
Restores support for source distributions containing hard links or full-length tar user or group names.
Detection is fixed for environments created from symlinked interpreters.
Uninstalls no longer delete unrelated files beside their storage directories.
Installs, syncs, and environment creation no longer fail when racing with cache cleanup.
Python 3.15-based images are published under stable tags.
Preserves device files and FIFOs used as output destinations.
Preserves device files and FIFOs used as output destinations.
Concurrent tool installations no longer corrupt an environment when the last tool is uninstalled.
Changed upgrade settings are persisted even when the tool version stays unchanged.
uv 0.1229 changes
Breaking changes 1
Malformed requirements-file options are rejected instead of being partially parsed or ignored.
Security 3
Enforces resource limits when parsing package indexes and
--find-linkspages withastral-html.Supplied hashes are verified even when hash presence is disabled with
require-hashes = false.uv: Path traversal on Windows through wheel extraction
New APIs and options 2
Supports custom installation mirrors for GraalPy.
Supports custom installation mirrors for Pyodide.
Performance 1
Warming the interpreter cache when creating an environment speeds up later commands.
Behavior and default changes 3
Accepts marker operators directly before grouped expressions.
Reports preferred advisory IDs, prioritizing PYSEC, GHSA, then CVE identifiers.
Setting
UV_NO_CACHE=falseoverridesno-cache = truein configuration.
Tooling 1
Removes orphaned temporary build environments when pruning the cache.
Fixes and other changes 18
Excludes optional dependencies when their extras are activated only in incompatible environments.
Resolves dependencies whose Git references contain
#or%characters.Supplied hashes are verified even when hash presence is disabled with this flag.
Dependency overrides and constraints no longer activate optional dependencies when their extras are not selected.
Recognizes existing Pyodide interpreters as satisfying Pyodide Python requests.
Honor exact managed Python patch pins instead of following patch upgrades when creating script environments.
Preserves trailing spaces and tabs in passwords returned by subprocess keyrings.
Hides the ignored
--keyring-provideroption from help.Allows login over IPv6 loopback addresses.
Setting
UV_OFFLINE=falseoverridesoffline = truein configuration.Explicit
--trusted-publishingvalues take precedence over configuration.Preserves JSON output when a single
--quietflag is supplied.Setting
UV_SYSTEM_CERTS=falseoverridessystem-certs = truein configuration.Reports HTTP client setup failures directly when resolving unnamed requirements.
Preserves JSON output when a single
--quietflag is supplied.Restores incompatibility hints when
WHEELmetadata contains multiple expandedTag:rows.Preserves rename errors unless a cross-drive copy fallback applies.
Prevents assertion failures after modifying a project at the workspace root.
uv 0.112 changes
Security 2
uv is vulnerable to arbitrary file write through entry point names
uv vulnerable to arbitrary file deletion through RECORD entries
uv 0.92 changes
Security 2
uv allows ZIP payload obfuscation through parsing differentials
uv has differential in tar extraction with PAX headers