# What changed in uv

> 74 changes in uv 0.9 to 0.13 from its official release notes, upgrade guides and advisories: 12 breaking, 7 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/pypi/uv/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## uv 0.13

### Breaking changes

- Ignores Requires-Python upper bounds, consistent with resolution. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Each option value is now treated as a single path, including quoted paths containing spaces; repeat the option to provide multiple files. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- Each option value is now treated as a single path, including quoted paths containing spaces; repeat the option to provide multiple files. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- Each option value is now treated as a single path, including quoted paths containing spaces; repeat the option to provide multiple files. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- Each option value is now treated as a single path, including quoted paths containing spaces; repeat the option to provide multiple files. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- Python 3.15 is now the default stable version for downloads when no version is requested or pinned; existing compatible installations continue to be used. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- uv now honors this directive in constraints files included with -c and requires hashes for all requirements in the installation. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- uv now uses tar-codec by default to extract archives, build source distributions with uv_build, and read metadata for uv publish; stricter validation may reject some archives. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- The command now rejects output directories containing a build source, including through symlinks, before clearing output. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- uv uses tar-codec for tar archives by default, applying stricter validation; set this variable to 1 to opt out. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- On Windows ARM64, uv now prefers native ARM64 interpreters; set this variable to x86_64 to opt out. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)

### New APIs and options

- This preview option requires hashes for build dependencies, including transitive dependencies. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)

### Performance

- Reduces overhead when parsing package metadata. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Simple API parsing is faster. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Reduces the size of the uv binary. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Many cache entry formats changed to improve performance; uv may download or rebuild dependencies after upgrading, while multiple uv versions can still safely share a cache directory. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)

### Behavior and default changes

- Supports Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Resolution errors now report missing trusted hashes. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Ignores Requires-Python upper bounds, consistent with resolution. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Enables preliminary parsing of PEP 825 variant labels in wheel filenames. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Space-separated lists remain supported in this environment variable despite the changed handling of requirement-file option values. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- Space-separated lists remain supported in this environment variable despite the changed handling of requirement-file option values. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- Space-separated lists remain supported in this environment variable despite the changed handling of requirement-file option values. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)
- Space-separated lists remain supported in this environment variable despite the changed handling of requirement-file option values. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)

### Tooling

- Adds support for CPython 3.16.0a1. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Can upgrade installed tools when tool-install-locks is enabled. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- If the [build-system] table has an upper bound on uv_build, update it to allow uv_build 0.13. (0.13.0) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.0)

### Fixes and other changes

- Environments with installed Git dependencies pinned to full commit hashes are reused without resolving again. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Concurrent readers can no longer observe partially written lockfiles. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Concurrent readers can no longer observe partially written managed Python sysconfig files. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Concurrent commands reaching the same environment through real and symlinked paths are serialized. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Concurrent readers can no longer observe partially written Python version files. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Restores support for source distributions containing hard links or full-length tar user or group names. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Detection is fixed for environments created from symlinked interpreters. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Uninstalls no longer delete unrelated files beside their storage directories. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Installs, syncs, and environment creation no longer fail when racing with cache cleanup. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Python 3.15-based images are published under stable tags. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Preserves device files and FIFOs used as output destinations. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Preserves device files and FIFOs used as output destinations. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Concurrent tool installations no longer corrupt an environment when the last tool is uninstalled. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)
- Changed upgrade settings are persisted even when the tool version stays unchanged. (0.13.1) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.13.1)

## uv 0.12

### Breaking changes

- Malformed requirements-file options are rejected instead of being partially parsed or ignored. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)

### Security

- Enforces resource limits when parsing package indexes and `--find-links` pages with `astral-html`. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Supplied hashes are verified even when hash presence is disabled with `require-hashes = false`. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- uv: Path traversal on Windows through wheel extraction (0.12.18) — [security advisory](https://github.com/advisories/GHSA-2CV4-CQWR-GWF7)

### New APIs and options

- Supports custom installation mirrors for GraalPy. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Supports custom installation mirrors for Pyodide. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)

### Performance

- Warming the interpreter cache when creating an environment speeds up later commands. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)

### Behavior and default changes

- Accepts marker operators directly before grouped expressions. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Reports preferred advisory IDs, prioritizing PYSEC, GHSA, then CVE identifiers. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Setting `UV_NO_CACHE=false` overrides `no-cache = true` in configuration. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)

### Tooling

- Removes orphaned temporary build environments when pruning the cache. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)

### Fixes and other changes

- Excludes optional dependencies when their extras are activated only in incompatible environments. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Resolves dependencies whose Git references contain `#` or `%` characters. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Supplied hashes are verified even when hash presence is disabled with this flag. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Dependency overrides and constraints no longer activate optional dependencies when their extras are not selected. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Recognizes existing Pyodide interpreters as satisfying Pyodide Python requests. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Honor exact managed Python patch pins instead of following patch upgrades when creating script environments. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Preserves trailing spaces and tabs in passwords returned by subprocess keyrings. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Hides the ignored `--keyring-provider` option from help. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Allows login over IPv6 loopback addresses. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Setting `UV_OFFLINE=false` overrides `offline = true` in configuration. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Explicit `--trusted-publishing` values take precedence over configuration. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Preserves JSON output when a single `--quiet` flag is supplied. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Setting `UV_SYSTEM_CERTS=false` overrides `system-certs = true` in configuration. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Reports HTTP client setup failures directly when resolving unnamed requirements. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Preserves JSON output when a single `--quiet` flag is supplied. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Restores incompatibility hints when `WHEEL` metadata contains multiple expanded `Tag:` rows. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Preserves rename errors unless a cross-drive copy fallback applies. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)
- Prevents assertion failures after modifying a project at the workspace root. (0.12.24) — [release notes](https://github.com/astral-sh/uv/releases/tag/0.12.24)

## uv 0.11

### Security

- uv is vulnerable to arbitrary file write through entry point names (0.11.15) — [security advisory](https://github.com/advisories/GHSA-4GG8-GXPX-9RPH)
- uv vulnerable to arbitrary file deletion through RECORD entries (0.11.6) — [security advisory](https://github.com/advisories/GHSA-PJJW-68HJ-V9MW)

## uv 0.9

### Security

- uv allows ZIP payload obfuscation through parsing differentials (0.9.6) — [security advisory](https://github.com/advisories/GHSA-PQHF-P39G-3X64)
- uv has differential in tar extraction with PAX headers (0.9.5) — [security advisory](https://github.com/advisories/GHSA-W476-P2H3-79G9)