chore(deps): update dependency astral-sh/uv to v0.8.22 #100
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
renovate
bot
force-pushed
the
renovate/astral-sh-uv-0.x
branch
6 times, most recently
from
6b56ef7 to
e199727
Compare
renovate
bot
force-pushed
the
renovate/astral-sh-uv-0.x
branch
from
e199727 to
754df08
Compare
Contributor
|
🎉 This PR is included in version 0.56.12 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.
This PR contains the following updates:
0.5.31->0.8.22Release Notes
astral-sh/uv (astral-sh/uv)
v0.8.22Compare Source
Released on 2025-09-23.
Python
Security
astral-tokio-tarto 0.5.5 which hardens tar archive extraction (#16004)v0.8.21Compare Source
Released on 2025-09-23.
Enhancements
--refreshis provided (#15994)Preview features
Add support for S3 request signing (#15925)
v0.8.20Compare Source
Released on 2025-09-22.
Enhancements
--forceflag foruv cache clean(#15992)Preview features
Bug fixes
freethreaded+debugPython downloads inuv python list(#15985)uv runanduvx(#15990)Documentation
packagelevel conflicts to the conflicting dependencies docs (#15963)v0.8.19Compare Source
Released on 2025-09-19.
Python
See the python-build-standalone release notes for more details.
Bug fixes
uv cache cleanparallel process safe (#15888)platform_machinemarker forwin_arm64platform tag (#15921)v0.8.18Compare Source
Released on 2025-09-17.
Enhancements
uv initdefaults for native build backend cache keys (#15705)pyproject.tomltarget does not exist for dependency groups (#15831)--no-cleartouv venvto disable removal prompts (#15795)--only-groupand--extraflags (#15788)[project]to be missing from apyproject.toml(#14113)baseandrootas base environments (#15682)uv_buildis skipped (#15898)_CONDA_ROOTto detect Conda base environments (#15680)uv publishupload form (#15794)uv sync(#15881)Deprecations
tool.uv.dev-dependencies(#15469)Preview features
native-authfeature (#15872)Bug fixes
uv sync --no-sourcesnot switching from editable to registry installations (#15234)@latest(#15827)tritonas a torch backend package (#15910)UV_INSECURE_NO_ZIP_VALIDATION=1in duplicate header errors (#15912)Documentation
NO_PROXYsupport (#15816)requires-python(#14282)v0.8.17Compare Source
Released on 2025-09-10.
Enhancements
PYX_API_URLwhen suggestinguv auth loginon 401 (#15774)Bug fixes
uv init --script(#15747)v0.8.16Compare Source
Enhancements
--editableto overrideeditable = falseannotations (#15712)editable = falsefor workspace sources (#15708)--with-requirementsand--requirements(#12763)Preview features
--no-projectinuv format(#15572)uv formatin unmanaged projects (#15553)Bug fixes
match-runtimetarget is optional (#15671)uv auth(#15743)uv publish(#15759)Documentation
uv authcommands take a URL (#15664)v0.8.15Compare Source
Python
Enhancements
uv authcommands for credential management (#15570)uv authcommands (#15636)uv tree --show-sizesto show package sizes (#15531)--python-platform riscv64-unknown-linux(#15630)--python-platformtouv runanduv tool(#15515)uv publish --dry-run(#15638)Bug fixes
extra-build-dependencies(#15622)Error messages
v0.8.14Compare Source
Python
Enhancements
--python-platformtouv pip check(#15486)UV_ISOLATED(#15428)--no-install-localoption touv sync,uv addanduv export(#15328)uv pipCLI (#15453)Preview features
{version}onuv formatfailure (#15527)uv formatto prevent races (#15551)--projectinuv format(#15438)uv formatin the project root (#15440)Configuration
Performance
WHEELandMETADATAreads in installed distributions (#15489)Bug fixes
venvin current working directory (#15537)uv publishchecks (#15545)uv venv(#15538)CLICOLOR_FORCE=1when calling build backends (#15472)Documentation
uvw.exeneeds to be removed (#15536)v0.8.13Compare Source
Enhancements
--no-install-*arguments touv add(#15375)uv init(#15377)Preview features
uv formatcommand (#15017)extra-build-dependenciesif match-runtime is explicitlyfalse(#15420)Bug fixes
tritontotorch-backendmanifest (#15405)uv_buildwheel hashes (#15400)--upgrade-packageon the command-line as overridingupgrade = falsein configuration (#15395)v0.8.12Compare Source
Python
See the python-build-standalone release notes for details.
Enhancements
aarch64-pc-windows-msvctarget forpython-platform(#15347)uv tool update-shell(#15356)buildpack-deps:trixie,debian:trixie-slim,alpine:3.22(#15351)Bug fixes
match-runtime = truefor dynamic packages (#15292)Documentation
uv cache cleaninstead ofclear(#15313)v0.8.11Compare Source
Python
Enhancements
extra-build-dependencieshint for any missing module on build failure (#15252)Bug fixes
Rust API
reqwestclients toRegistryClient(#15281)v0.8.10Compare Source
Python
Enhancements
aarch64(#14399)Preview
v0.8.9Compare Source
Enhancements
--reinstallflag touv python upgrade(#15194)Bug fixes
uv python upgradeif they don't already exist (#15192)Documentation
v0.8.8Compare Source
Bug fixes
find_uv_bincompatibility with Python <3.10 (#15177)v0.8.7Compare Source
Python
tkaggbackend (the default on Linux), Pillow'sPIL.ImageTklibrary, and other extension modules that need to use libtcl/libtk directly.See the
python-build-standalonerelease notes for details.Enhancements
uv.lockwhen using--isolated(#15154)--prefixand--withinstallations infind_uv_bin(#14184)find_uv_bin(#14181)find_uv_bin(#14182)Preview features
package-level conflicts in workspaces (#14906)Configuration
UV_DEVandUV_NO_DEVenvironment variables (for--devand--no-dev) (#15010)Bug fixes
--require-hashesapplied to build dependencies inuv pip install(#15153)find_uv_bin(#14191)Documentation
.) to list elements inFeaturesdocs page (#15138)v0.8.6Compare Source
This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parser (CVE-2025-54368).
Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs.
Thanks to a triage effort with the Python Security Response Team and PyPI maintainers, we were able to determine that these differentials were not exploited via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload.
Although the practical risk of exploitation is low, we take the hypothetical risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this advisory a CVE identifier and have given it a "moderate" severity suggestion.
These changes have been validated against the top 15,000 PyPI packages; however, it's plausible that a non-malicious ZIP could be falsely rejected with this additional hardening. As an escape hatch, users who do encounter breaking changes can enable
UV_INSECURE_NO_ZIP_VALIDATIONto restore the previous behavior. If you encounter such a rejection, please file an issue in uv and to the upstream package.For additional information, please refer to the following blog posts:
Security
Python
Configuration
Bug fixes
UV_HTTP_RETRIESinuv publish(#15106)UV_NO_EDITABLEwhere--no-editableis supported (#15107)cargo-distto addUV_INSTALLER_URLto PowerShell installer (#15114)h2again to avoidtoo_many_internal_resetserrors (#15111)pythonwwhen copying entry points in uv run (#15134)Documentation
v0.8.5Compare Source
Enhancements
uv runwith a GitHub Gist (#15058)uv tool install(#14014)Preview features
extra-build-dependencieswarnings foruv pip(#15088)pylockwarning (#15089)Bug fixes
python-preference = systemwhen managed interpreters are on the PATH (#15059)--systemis used (#15061)h2upgrade (#15079)Documentation
v0.8.4Compare Source
Enhancements
Preview features
extra-build-dependencies(#14735)Configuration
exclude-newerdates viaexclude-newer-package(#14489)Bug fixes
pythonvspython3(#14970)environmentsandrequired-environmentsinuv.toml(#14905)Documentation
uv_buildin projects documentation (#14968)UV_prefix to installer environment variables (#14964)uvfrom--build-backendoptions (#14939)v0.8.3Compare Source
Python
See the
python-build-standalonerelease notes for more details.Enhancements
uv_build(#14867)Bug fixes
--withversions over base environment versions (#14863)Documentation
uv_buildreference documentation (#14853)v0.8.2Compare Source
Released on 2025-09-23.
Python
Security
astral-tokio-tarto 0.5.5 which hardens tar archive extraction (#16004)v0.8.1Compare Source
Released on 2025-09-19.
Python
See the python-build-standalone release notes for more details.
Bug fixes
uv cache cleanparallel process safe (#15888)platform_machinemarker forwin_arm64platform tag (#15921)v0.8.0Compare Source
Since we released uv 0.7.0 in April, we've accumulated various changes that improve correctness and user experience, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. We expect most users to be able to upgrade without making changes.
This release also includes the stabilization of a couple
uv python installfeatures, which have been available under preview since late last year.Breaking changes
Install Python executables into a directory on the
PATH(#14626)uv python installnow installs a versioned Python executable (e.g.,python3.13) into a directory on thePATH(e.g.,~/.local/bin) by default. This behavior has been available under the--previewflag since Oct 2024. This change should not be breaking unless it shadows a Python executable elsewhere on thePATH.To install unversioned executables, i.e.,
python3andpython, use the--defaultflag. The--defaultflag has also been in preview, but is not stabilized in this release.Note that these executables point to the base Python installation and only include the standard library. That means they will not include dependencies from your current project (use
uv run pythoninstead) and you cannot install packages into their environment (useuvx --with <package> pythoninstead).As with tool installation, the target directory respects common variables like
XDG_BIN_HOMEand can be overridden with aUV_PYTHON_BIN_DIRvariable.You can opt out of this behavior with
uv python install --no-binorUV_PYTHON_INSTALL_BIN=0.See the documentation on installing Python executables for more details.
Register Python versions with the Windows Registry (#14625)
uv python installnow registers the installed Python version with the Windows Registry as specified by PEP 514. This allows using uv installed Python versions via thepylauncher. This behavior has been available under the--previewflag since Jan 2025. This change should not be breaking, as using the uv Python versions withpyrequires explicit opt in.You can opt out of this behavior with
uv python install --no-registryorUV_PYTHON_INSTALL_REGISTRY=0.Prompt before removing an existing directory in
uv venv(#14309)Previously,
uv venvwould remove an existing virtual environment without confirmation. While this is consistent with the behavior of project commands (e.g.,uv sync), it's surprising to users that are using imperative workflows (i.e.,uv pip). Now,uv venvwill prompt for confirmation before removing an existing virtual environment. If not in an interactive context, uv will still remove the virtual environment for backwards compatibility. However, this behavior is likely to change in a future release.The behavior for other commands (e.g.,
uv sync) is unchanged.You can opt out of this behavior by setting
UV_VENV_CLEAR=1or passing the--clearflag.Validate that discovered interpreters meet the Python preference (#7934)
uv allows opting out of its managed Python versions with the
--no-managed-pythonandpython-preferenceoptions.Previously, uv would not enforce this option for Python interpreters discovered on the
PATH. For example, if a symlink to a managed Python interpreter was created, uv would allow it to be used even if--no-managed-pythonwas provided. Now, uv ignores Python interpreters that do not match the Python preference unless they are in an active virtual environment or are explicitly requested, e.g., with--python /path/to/python3.13.Similarly, uv would previously not invalidate existing project environments if they did not match the Python preference. Now, uv will invalidate and recreate project environments when the Python preference changes.
You can opt out of this behavior by providing the explicit path to the Python interpreter providing
--managed-python/--no-managed-pythonmatching the interpreter you want.Install dependencies without build systems when they are
pathsources (#14413)When working on a project, uv uses the presence of a build system to determine if it should be built and installed into the environment. However, when a project is a dependency of another project, it can be surprising for the dependency to be missing from the environment.
Previously, uv would not build and install dependencies with
pathsources unless they declared a build system or settool.uv.package = true. Now, dependencies withpathsources are built and installed regardless of the presence of a build system. If a build system is not present, thesetuptools.build_meta:__legacy__backend will be used (per PEP 517).You can opt out of this behavior by setting
package = falsein the source declaration, e.g.:Or, by setting
tool.uv.package = falsein the dependentpyproject.toml.See the documentation on virtual dependencies for details.
Install dependencies without build systems when they are workspace members (#14663)
As described above for dependencies with
pathsources, uv previously would not build and install workspace members that did not declare a build system. Now, uv will build and install workspace members that are a dependency of another workspace member regardless of the presence of a build system. The behavior is unchanged for workspace members that are not included in theproject.dependencies,project.optional-dependencies, ordependency-groupstables of another workspace member.You can opt out of this behavior by setting
tool.uv.package = falsein the workspace member'spyproject.toml.See the documentation on virtual dependencies for details.
Bump
--python-platform linuxtomanylinux_2_28(#14300)uv allows performing platform-specific resolution for explicit targets and provides short aliases, e.g.,
linux, for common targets.Previously, the default target for
--python-platform linuxwasmanylinux_2_17, which is compatible with most Linux distributions from 2014 or newer. We now default tomanylinux_2_28, which is compatible with most Linux distributions from 2019 or newer. This change follows the lead of other tools, such ascibuildwheel, which changed their default tomanylinux_2_28in Mar 2025.This change only affects users requesting a specific target platform. Otherwise, uv detects the
manylinuxtarget from your local glibc version.You can opt out of this behavior by using
--python-platform x86_64-manylinux_2_17instead.Remove
uv versionfallback (#14161)In Apr 2025, uv changed the
uv versioncommand to an interface for viewing and updating the version of the current project. However, when outside a project,uv versionwould continue to display uv's version for backwards compatibility. Now, when used outside of a project,uv versionwill fail.You cannot opt out of this behavior. Use
uv self versioninstead.Require
--globalfor removal of the global Python pin (#14169)Previously,
uv python pin --rmwould allow you to remove the global Python pin without opt in. Now, uv requires the--globalflag to remove the global Python pin.You cannot opt out of this behavior. Use the
--globalflag instead.Support conflicting editable settings across groups (#14197)
Previously, uv would always treat a package as editable if any requirement requested it as editable. However, this prevented users from declaring
pathsources that toggled theeditablesetting across dependency groups. Now, uv allows declaring differenteditablevalues for conflicting groups. However, if a project includes a path dependency twice, once witheditable = trueand once without any editable annotation, those are now considered conflicting, and uv will exit with an error.You cannot opt out of this behavior. Use consistent
editablesettings or mark groups as conflicting.Make
uv_buildthe default build backend inuv init(#14661)The uv build backend (
uv_build) was stabilized in uv 0.7.19. Now, it is the default build backend foruv init --packageanduv init --lib. Previously,hatchlingwas the default build backend. A build backend is still not used without opt-in inuv init, but we expect to change this in a future release.You can opt out of this behavior with
uv init --build-backend hatchling.Set default
UV_TOOL_BIN_DIRon Docker images (#13391)Previously,
UV_TOOL_BIN_DIRwas not set in Docker images which meant thatuv tool installdid not install tools into a directory on thePATHwithout additional configuration. Now,UV_TOOL_BIN_DIRis set to/usr/local/binin all Docker derived images.When the default image user is overridden (e.g.
USER <UID>) with a less privileged user, this may causeuv tool installto fail.You can opt out of this behavior by setting an alternative
UV_TOOL_BIN_DIR.Update
--checkto return an exit code of 1 (#14167)uv uses an exit code of 1 to indicate a "successful failure" and an exit code of 2 to indicate an "error".
Previously,
uv lock --checkanduv sync --checkwould exit with a code of 2 when the lockfile or environment were outdated. Now, uv will exit with a code of 1.You cannot opt out of this behavior.
Use an ephemeral environment for
uv run --withinvocations (#14447)When using
uv run --with, uv layers the requirements requested using--withinto another virtual environment and caches it. Previously, uv would invoke the Python interpreter in this layered environment. However, this allows poisoning the cached environment and introduces race conditions for concurrent invocations. Now, uv will layer another empty virtual environment on top of the cached environment and invoke the Python interpreter there. This should only cause breakage in cases where the environment is being inspected at runtime.You cannot opt out of this behavior.
Restructure the
uv venvcommand output and exit codes (#14546)Previously, uv used
mietteto format theuv venvoutput. However, this was inconsistent with most of the uv CLI. Now, the output is a little different and the exit code has switched from 1 to 2 for some error cases.You cannot opt out of this behavior.
Default to
--workspacewhen adding subdirectories (#14529)When using
uv addto add a subdirectory in a workspace, uv now defaults to adding the target as a workspace member.You can opt out of this behavior by providing
--no-workspace.Add missing validations for disallowed
uv.tomlfields (#14322)uv does not allow some settings in the
uv.toml. Previously, some settings were silently ignored when present in theuv.toml. Now, uv will error.You cannot opt out of this behavior. Use
--no-configor remove the invalid settings.Configuration
v0.7.22Compare Source
Release Notes
Python
See the GraalPy release notes for more details.
Configuration
UV_COMPILE_BYTECODE_TIMEOUTenvironment variable (#14369)cache-controlheaders (#14620)UV_LIBCto override libc selection in multi-libc environment (#14646)Bug fixes
--all-archeswhen paired with--only-downloads(#14629)uv.tomlwhen provided via direct path (#14653)Documentation
revisionin the lockfile versioning doc (#14634)uv cache cleanprior to--reinstall(#14659)Preview features
uv python update-shell(#14627)Install uv 0.7.22
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.7.22/uv-installer.ps1 | iex"Download uv 0.7.22