uv 0.12.0: Stricter Security, Better Defaults, and Safer Python Packaging
We are releasing uv 0.12.0 with significant improvements to correctness and safety. This update restores default build system definitions for new projects, enforces strict archive formats, and blocks malicious wheel files that could overwrite Python interpreters. We also refine pre-release resolution logic and tighten hash-checking requirements to align with security best practices. Most users can upgrade without changes, though some legacy workflows may need adjustments.
Wheels could also place interpreter files in their .data/scripts directory or in paths such as .data/data/bin/python, bypassing the entry-point check and replacing the interpreter during installation.
- woodruffw
This is our first breaking release since March. We’re happy to answer any questions folks have about it.
- drzhouq
When can uv install gdal?
- yablak
thoughts on worm safety w.r.t. `exclude-newer`, and the right way to handle unpinned git repo deps?
- XorNot
Are we likely to get an "uv upgrade" command that makes sense sometime?
It's still very obtuse how to get uv to just try and make all my dependencies the highest version possible.
- analognoise
uv fucks, especially with uv2nix.