- update to 0.9.24
* Enhancements
* Use a dedicated error message when lockfile can't be found
* Only write portable paths in RECORD files
* Support relative paths in UV_PYTHON_BIN_DIR and UV_TOOL_BIN_DIR
* Preview features
* Enable uploads to S3 via pre-signed URLs
* Configuration
* Allow setting proxy variables via global / user configuration
* Manually parse and reconcile Boolean environment variables
* Bug fixes
* Fix handling of UV_NO_SYNC=1 uv run ...
* Rebuild dynamic distribution when version changes with --no-cache
* Filter unusable wheels from the lockfile for more architectures
* Correctly count retries originating from early middleware errors
* Avoid broken build artifacts on build failure
* Fix missing dependencies on synthetic root in SBOM export
* Recognize armv8l as an alias for armv7l in platform tag parsing
* Fix redaction of a URL in a middleware trace log
* Documentation
* Add index.md suggestion to llms.txt
* Clarify that uv run uses inexact syncing by default
* Clarify requirements file format in docs
* Add Rust language classifier
OBS-URL: https://build.opensuse.org/request/show/1326950
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=71
* Enhancements
* Use a dedicated error message when lockfile can't be found
* Only write portable paths in RECORD files
* Support relative paths in UV_PYTHON_BIN_DIR and UV_TOOL_BIN_DIR
* Preview features
* Enable uploads to S3 via pre-signed URLs
* Configuration
* Allow setting proxy variables via global / user configuration
* Manually parse and reconcile Boolean environment variables
* Bug fixes
* Fix handling of UV_NO_SYNC=1 uv run ...
* Rebuild dynamic distribution when version changes with --no-cache
* Filter unusable wheels from the lockfile for more architectures
* Correctly count retries originating from early middleware errors
* Avoid broken build artifacts on build failure
* Fix missing dependencies on synthetic root in SBOM export
* Recognize armv8l as an alias for armv7l in platform tag parsing
* Fix redaction of a URL in a middleware trace log
* Documentation
* Add index.md suggestion to llms.txt
* Clarify that uv run uses inexact syncing by default
* Clarify requirements file format in docs
* Add Rust language classifier
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=163
- update to 0.9.21
* Bug fixes
* Avoid enforcing incorrect hash in mixed-hash settings
* Fix retry counts in cached client
* Respect UV_PYTHON_DOWNLOAD_MIRROR in uv python list
* Support remote pylock.toml files
* Avoid flagging proxied Git URLs as ambiguous authority
* Fix dropped support of - in pip constraints, overrides, and excludes
* Fix regression where zstd distribution hashes were not considered valid
* Documentation
* Fix a typo in the resolution documentation
* Fix a typo in python install --default documentation
* Enhancements
* Allow uv pip compile to install missing python interpreters in cases where it would otherwise fail
* Avoid creating file contents with uv init --bare --script
* Respect --torch-backend in uv tool commands
* Support comma-separated values in --no-binary and --only-binary
* Preview features
* Summarize package changes in uv sync with JSON output format
* Performance
* Avoid two hot String allocations in deserialization
* Cache NVIDIA-hosted wheels by default
OBS-URL: https://build.opensuse.org/request/show/1325232
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=70
* Bug fixes
* Avoid enforcing incorrect hash in mixed-hash settings
* Fix retry counts in cached client
* Respect UV_PYTHON_DOWNLOAD_MIRROR in uv python list
* Support remote pylock.toml files
* Avoid flagging proxied Git URLs as ambiguous authority
* Fix dropped support of - in pip constraints, overrides, and excludes
* Fix regression where zstd distribution hashes were not considered valid
* Documentation
* Fix a typo in the resolution documentation
* Fix a typo in python install --default documentation
* Enhancements
* Allow uv pip compile to install missing python interpreters in cases where it would otherwise fail
* Avoid creating file contents with uv init --bare --script
* Respect --torch-backend in uv tool commands
* Support comma-separated values in --no-binary and --only-binary
* Preview features
* Summarize package changes in uv sync with JSON output format
* Performance
* Avoid two hot String allocations in deserialization
* Cache NVIDIA-hosted wheels by default
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=161
- update to 0.9.18
* Enhancements
* Add value hints to command line arguments to improve shell completion accuracy
* Improve error handling in uv publish
* Improve rendering of multiline error messages
* Support redirects in uv publish
* Configuration
* Accept --torch-backend in [tool.uv]
* Performance
* Speed up uv cache size
* Initialize S3 signer once
* Bug fixes
* Avoid panics due to reads on failed requests
* Enforce latest-version in @latest requests
* Explicitly set EntryType for file entries in tar
* Ignore pyproject.toml index username in lockfile comparison
* Relax error when using uv add with UV_GIT_LFS set
* Change schema for exclude-newer into optional string
* Documentation
* Fix version reference in resolver example
* Better documentation for exclude-newer*
OBS-URL: https://build.opensuse.org/request/show/1323925
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=69
* Enhancements
* Add value hints to command line arguments to improve shell completion accuracy
* Improve error handling in uv publish
* Improve rendering of multiline error messages
* Support redirects in uv publish
* Configuration
* Accept --torch-backend in [tool.uv]
* Performance
* Speed up uv cache size
* Initialize S3 signer once
* Bug fixes
* Avoid panics due to reads on failed requests
* Enforce latest-version in @latest requests
* Explicitly set EntryType for file entries in tar
* Ignore pyproject.toml index username in lockfile comparison
* Relax error when using uv add with UV_GIT_LFS set
* Change schema for exclude-newer into optional string
* Documentation
* Fix version reference in resolver example
* Better documentation for exclude-newer*
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=159
- update to 0.9.17
* Enhancements
* Add torch-tensorrt and torchao to the PyTorch list
* Add hint for misplaced --verbose in uv tool run
* Add support for relative durations in exclude-newer (a.k.a., dependency cooldowns)
* Add support for relocatable nushell activation script
* Bug fixes
* Respect dropped (but explicit) indexes in dependency groups
* Documentation
* Improve source-exclude reference docs
* Recommend UV_NO_DEV in Docker installs
* Update UV_VERSION in docs for GitLab CI/CD
OBS-URL: https://build.opensuse.org/request/show/1322090
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=68
* Enhancements
* Add torch-tensorrt and torchao to the PyTorch list
* Add hint for misplaced --verbose in uv tool run
* Add support for relative durations in exclude-newer (a.k.a., dependency cooldowns)
* Add support for relocatable nushell activation script
* Bug fixes
* Respect dropped (but explicit) indexes in dependency groups
* Documentation
* Improve source-exclude reference docs
* Recommend UV_NO_DEV in Docker installs
* Update UV_VERSION in docs for GitLab CI/CD
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=157
- update to 0.9.16
* Enhancements
* Add a 5m default timeout to acquiring file locks to fail faster on deadlock
* Add a stub debug subcommand to uv pip announcing its intentional absence
* Add bounds in uv add --script
* Add brew specific message for uv self update
* Error when built wheel is for the wrong platform
* Filter wheels from PEP 751 files based on --no-binary et al in uv pip compile
* Support --target and --prefix in uv pip list, uv pip freeze, and uv pip show
* Tweak language for build backend validation errors
* Use explicit credentials cache instead of global static
* Enable SIMD in HTML parsing
* Preview features
* Fix missing preview warning in uv workspace metadata
* Add a uv auth helper --protocol bazel command
* Bug fixes
* Fix Pyston wheel compatibility tags
* Allow redundant entries in tool.uv.build-backend.module-name but emit warnings
* Fix infinite loop in non-attribute re-treats during HTML parsing
* Documentation
* Clarify --project flag help text to indicate project discovery
* Regenerate the crates.io READMEs on release
* Update Docker integration guide to prefer COPY over ADD for simple cases
* Update PyTorch documentation to include information about supporting CUDA 13.0.x
* Update the versioning policy
* Upgrade PyTorch documentation to latest versions
OBS-URL: https://build.opensuse.org/request/show/1321536
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=67
* Enhancements
* Add a 5m default timeout to acquiring file locks to fail faster on deadlock
* Add a stub debug subcommand to uv pip announcing its intentional absence
* Add bounds in uv add --script
* Add brew specific message for uv self update
* Error when built wheel is for the wrong platform
* Filter wheels from PEP 751 files based on --no-binary et al in uv pip compile
* Support --target and --prefix in uv pip list, uv pip freeze, and uv pip show
* Tweak language for build backend validation errors
* Use explicit credentials cache instead of global static
* Enable SIMD in HTML parsing
* Preview features
* Fix missing preview warning in uv workspace metadata
* Add a uv auth helper --protocol bazel command
* Bug fixes
* Fix Pyston wheel compatibility tags
* Allow redundant entries in tool.uv.build-backend.module-name but emit warnings
* Fix infinite loop in non-attribute re-treats during HTML parsing
* Documentation
* Clarify --project flag help text to indicate project discovery
* Regenerate the crates.io READMEs on release
* Update Docker integration guide to prefer COPY over ADD for simple cases
* Update PyTorch documentation to include information about supporting CUDA 13.0.x
* Update the versioning policy
* Upgrade PyTorch documentation to latest versions
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=155
- update to 0.9.15
* Enhancements
* Add ROCm 6.4 to --torch-backend=auto
* Add a Windows manifest to uv binaries
* Add LFS toggle to Git sources
* Cache source reads during resolution
* Allow reading requirements from scripts without an extension
* Allow reading requirements from scripts with HTTP(S) paths
* Configuration
* Add UV_HIDE_BUILD_OUTPUT to omit build logs
* Bug fixes
* Fix uv-trampoline-builder builds from crates.io by moving bundled executables
* Respect NO_COLOR and always show the command as a header when paging uv help output
* Use 0o666 permissions for flock files instead of 0o777
* Revert "Bump astral-tl to v0.7.10 " to narrow down a regression causing hangs in metadata retrieval (#16938)
* Documentation
* Link to the uv version in crates.io member READMEs
OBS-URL: https://build.opensuse.org/request/show/1320996
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=66
* Enhancements
* Add ROCm 6.4 to --torch-backend=auto
* Add a Windows manifest to uv binaries
* Add LFS toggle to Git sources
* Cache source reads during resolution
* Allow reading requirements from scripts without an extension
* Allow reading requirements from scripts with HTTP(S) paths
* Configuration
* Add UV_HIDE_BUILD_OUTPUT to omit build logs
* Bug fixes
* Fix uv-trampoline-builder builds from crates.io by moving bundled executables
* Respect NO_COLOR and always show the command as a header when paging uv help output
* Use 0o666 permissions for flock files instead of 0o777
* Revert "Bump astral-tl to v0.7.10 " to narrow down a regression causing hangs in metadata retrieval (#16938)
* Documentation
* Link to the uv version in crates.io member READMEs
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=153
- update to 0.9.14
* Performance
* Bump astral-tl to v0.7.10 to enable SIMD for HTML parsing
* Bug fixes
* Allow earlier post releases with exclusive ordering
* Prefer updating existing .zshenv over creating a new one in tool update-shell
* Respect -e flags in uv add
* Enhancements
* Attach subcommand to User-Agent string
* Prefer UV_WORKING_DIR over UV_WORKING_DIRECTORY for consistency
OBS-URL: https://build.opensuse.org/request/show/1320813
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=65
* Performance
* Bump astral-tl to v0.7.10 to enable SIMD for HTML parsing
* Bug fixes
* Allow earlier post releases with exclusive ordering
* Prefer updating existing .zshenv over creating a new one in tool update-shell
* Respect -e flags in uv add
* Enhancements
* Attach subcommand to User-Agent string
* Prefer UV_WORKING_DIR over UV_WORKING_DIRECTORY for consistency
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=151
- update to 0.9.13
* Bug fixes
* Validate URL wheel tags against Requires-Python and required environments
* Enhancements
* Allow --with-requirements to load extensionless inline-metadata scripts
* Collect and upload PEP 740 attestations during uv publish
* Prevent uv export from overwriting pyproject.toml
* Documentation
* Drop unpublished crates from the uv crates.io README
* Fix the links to uv in crates.io member READMEs
* Add a crates.io README for uv
* Add documentation for intermediate Docker layers in a workspace
* Enumerate workspace members in the uv crate README
* Fix documentation links for crates
* Generate a crates.io README for uv workspace members
* Move the "Export" guide to the projects concept section
* Update the cargo install recommendation to use crates
* Use the word "internal" in crate descriptions
OBS-URL: https://build.opensuse.org/request/show/1320341
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=64
* Bug fixes
* Validate URL wheel tags against Requires-Python and required environments
* Enhancements
* Allow --with-requirements to load extensionless inline-metadata scripts
* Collect and upload PEP 740 attestations during uv publish
* Prevent uv export from overwriting pyproject.toml
* Documentation
* Drop unpublished crates from the uv crates.io README
* Fix the links to uv in crates.io member READMEs
* Add a crates.io README for uv
* Add documentation for intermediate Docker layers in a workspace
* Enumerate workspace members in the uv crate README
* Fix documentation links for crates
* Generate a crates.io README for uv workspace members
* Move the "Export" guide to the projects concept section
* Update the cargo install recommendation to use crates
* Use the word "internal" in crate descriptions
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=149
- update to 0.9.11
* Enhancements
* Add SBOM support to uv export
* Publish to crates.io
* Preview features
* Add uv workspace list --paths
* Fix the preview warning on uv workspace dir
* Bug fixes
* Fix uv init author serialization via toml_edit inline tables
* Fix status messages without TTY
* Preserve end-of-line comment whitespace when editing pyproject.toml
* Disable always-authenticate when running under Dependabot
* Documentation
* Document the new behavior for free-threaded python versions
* Improve note about build system in publish guide
* Move do not upload publish note out of the guide into concepts
OBS-URL: https://build.opensuse.org/request/show/1319716
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=63
* Enhancements
* Add SBOM support to uv export
* Publish to crates.io
* Preview features
* Add uv workspace list --paths
* Fix the preview warning on uv workspace dir
* Bug fixes
* Fix uv init author serialization via toml_edit inline tables
* Fix status messages without TTY
* Preserve end-of-line comment whitespace when editing pyproject.toml
* Disable always-authenticate when running under Dependabot
* Documentation
* Document the new behavior for free-threaded python versions
* Improve note about build system in publish guide
* Move do not upload publish note out of the guide into concepts
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=147
- update to 0.9.10
* Enhancements
* Add support for SSL_CERT_DIR
* Enforce UTF‑8-encoded license files during uv build
* Error when a project.license-files glob matches nothing
* pip install --target (and sync) install Python if necessary
* Account for python_downloads_json_url in pre-release Python version warnings
* Support HTTP/HTTPS URLs in uv python --python-downloads-json-url
* Preview features
* Add support for --upgrade in uv python install
* Fix handling of python install --default for pre-release Python versions
* Add uv workspace list to list workspace members
* Bug fixes
* Don't check file URLs for ambiguously parsed credentials
* Documentation
* Add a "storage" reference document
OBS-URL: https://build.opensuse.org/request/show/1318475
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=62
* Enhancements
* Add support for SSL_CERT_DIR
* Enforce UTF‑8-encoded license files during uv build
* Error when a project.license-files glob matches nothing
* pip install --target (and sync) install Python if necessary
* Account for python_downloads_json_url in pre-release Python version warnings
* Support HTTP/HTTPS URLs in uv python --python-downloads-json-url
* Preview features
* Add support for --upgrade in uv python install
* Fix handling of python install --default for pre-release Python versions
* Add uv workspace list to list workspace members
* Bug fixes
* Don't check file URLs for ambiguously parsed credentials
* Documentation
* Add a "storage" reference document
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=145
* Deprecations
* Deprecate use of --project in uv init
* Enhancements
* Add iOS support to Python interpreter discovery
* Reject ambiguously parsed URLs
* Allow explicit values in uv version --bump
* Warn on use of managed pre-release Python versions when a stable version
is available
* Allow signing trampolines on Windows by using .rcdata to store metadata
* Add --only-emit-workspace and similar variants to uv export
* Preview features
* Add uv workspace dir command
* Add uv workspace metadata command
* Configuration
* Add UV_NO_DEFAULT_GROUPS environment variable
* Bug fixes
* Remove torch-model-archiver and torch-tb-profiler from PyTorch backend
* Fix Pixi environment detection
* Documentation
* Fix CMD path in FastAPI Dockerfile
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=143
- update to 0.9.8
* Enhancements
* Accept multiple packages in uv export
* Accept multiple packages in uv sync
* Add a uv cache size command
* Add prerelease guidance for build-system resolution failures
* Allow Python requests to include +gil to require a GIL-enabled interpreter
* Avoid pluralizing 'retry' for single value
* Enable first-class dependency exclusions
* Fix inclusive constraints on available package versions in resolver errors
* Improve uv init error for invalid directory names
* Show help on uv build -h
* Include the Python variant suffix in "Using Python ..." messages
* Log most recently modified file for cache-keys
* Configuration
* Expose UV_NO_GROUP as an environment variable
* Add UV_NO_SOURCES as an environment variable
* Bug fixes
* Allow --check and --locked to be used together in uv lock
* Allow for unnormalized names in the METADATA file
* Fix missing value_type for default-groups in schema
* Respect multi-GPU outputs in nvidia-smi
* Documentation
* Fix typo in uv tool list doc
* Note uv pip list name normalization in docs
OBS-URL: https://build.opensuse.org/request/show/1316891
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=60
* Enhancements
* Accept multiple packages in uv export
* Accept multiple packages in uv sync
* Add a uv cache size command
* Add prerelease guidance for build-system resolution failures
* Allow Python requests to include +gil to require a GIL-enabled interpreter
* Avoid pluralizing 'retry' for single value
* Enable first-class dependency exclusions
* Fix inclusive constraints on available package versions in resolver errors
* Improve uv init error for invalid directory names
* Show help on uv build -h
* Include the Python variant suffix in "Using Python ..." messages
* Log most recently modified file for cache-keys
* Configuration
* Expose UV_NO_GROUP as an environment variable
* Add UV_NO_SOURCES as an environment variable
* Bug fixes
* Allow --check and --locked to be used together in uv lock
* Allow for unnormalized names in the METADATA file
* Fix missing value_type for default-groups in schema
* Respect multi-GPU outputs in nvidia-smi
* Documentation
* Fix typo in uv tool list doc
* Note uv pip list name normalization in docs
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=141
- Update to 0.9.7
* Enhancements
* Add Windows x86-32 emulation support to interpreter architecture checks
* Improve readability of progress bars
* Add GitHub attestations for uv release artifacts
* Add --clear to uv build to remove old build artifacts
* Add --no-create-gitignore to uv build
* Do not error when a virtual environment directory cannot be removed due to a busy error
* Improve hint on pip install --system when externally managed
* Running uv lock --check with outdated lockfile will print that --check was passed, instead of --locked
* Update uv init template for Maturin
* Improve ordering of Python sources in logs
* Restore DockerHub release images and annotations
* Bug fixes
* Check for matching Python implementation during uv python upgrade
* Deterministically order --find-links distributions
* Don't panic in uv export --frozen when the lockfile is outdated
* Fix root of uv tree when --package is used with circular dependencies
* Show package list with pip freeze --quiet
* Limit uv auth login pyx.dev retries to 60s
* Add an empty group with uv add --group ... -r ...
* Drop terminal coloring from uv auth token output
* Don't use UV_LOCKED to enable --check flag
- This release contains an upgrade to Astral's fork of async_zip, which addresses potential sources of ZIP
parsing differentials between uv and other Python packaging tooling.
See GHSA-pqhf-p39g-3x64 for additional details.
* Security
* Address ZIP parsing differentials (GHSA-pqhf-p39g-3x64)
* Documentation
* Update docs for maturin build backend init template
OBS-URL: https://build.opensuse.org/request/show/1315000
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=59
* Enhancements
* Add Windows x86-32 emulation support to interpreter architecture checks
* Improve readability of progress bars
* Add GitHub attestations for uv release artifacts
* Add --clear to uv build to remove old build artifacts
* Add --no-create-gitignore to uv build
* Do not error when a virtual environment directory cannot be removed due to a busy error
* Improve hint on pip install --system when externally managed
* Running uv lock --check with outdated lockfile will print that --check was passed, instead of --locked
* Update uv init template for Maturin
* Improve ordering of Python sources in logs
* Restore DockerHub release images and annotations
* Bug fixes
* Check for matching Python implementation during uv python upgrade
* Deterministically order --find-links distributions
* Don't panic in uv export --frozen when the lockfile is outdated
* Fix root of uv tree when --package is used with circular dependencies
* Show package list with pip freeze --quiet
* Limit uv auth login pyx.dev retries to 60s
* Add an empty group with uv add --group ... -r ...
* Drop terminal coloring from uv auth token output
* Don't use UV_LOCKED to enable --check flag
- This release contains an upgrade to Astral's fork of async_zip, which addresses potential sources of ZIP
parsing differentials between uv and other Python packaging tooling.
See GHSA-pqhf-p39g-3x64 for additional details.
* Security
* Address ZIP parsing differentials (GHSA-pqhf-p39g-3x64)
* Documentation
* Update docs for maturin build backend init template
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=139
- update to 0.9.5 (bsc#1252399, CVE-2025-62518)
This release contains an upgrade to astral-tokio-tar, which addresses
a vulnerability in tar extraction on malformed archives with
mismatching size information between the ustar header and PAX
extensions. While the astral-tokio-tar advisory has been graded as
"high" due its potential broader impact, the specific impact to uv is
low due to a lack of novel attacker capability. Specifically, uv only
processes tar archives from source distributions, which already
possess the capability for full arbitrary code execution by design,
meaning that an attacker gains no additional capabilities through
astral-tokio-tar.
Regardless, we take the hypothetical risk of parser differentials very
seriously. Out of an abundance of caution, we have assigned this
upgrade an advisory:
https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
* Security
* Upgrade astral-tokio-tar to 0.5.6 to address a parsing
differential (#16387)
* Enhancements
* Add required environment marker example to hint (#16244)
* Fix typo in MissingTopLevel warning (#16351)
* Improve 403 Forbidden error message to indicate package may not
exist (#16353)
* Add a hint on uv pip install failure if the --system flag is
used to select an externally managed interpreter (#16318)
* Bug fixes
* Fix backtick escaping for PowerShell (#16307)
* Documentation
* Document metadata consistency expectation (#15683)
* Remove outdated aarch64 musl note (#16385)
OBS-URL: https://build.opensuse.org/request/show/1313007
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=58
This release contains an upgrade to astral-tokio-tar, which addresses
a vulnerability in tar extraction on malformed archives with
mismatching size information between the ustar header and PAX
extensions. While the astral-tokio-tar advisory has been graded as
"high" due its potential broader impact, the specific impact to uv is
low due to a lack of novel attacker capability. Specifically, uv only
processes tar archives from source distributions, which already
possess the capability for full arbitrary code execution by design,
meaning that an attacker gains no additional capabilities through
astral-tokio-tar.
Regardless, we take the hypothetical risk of parser differentials very
seriously. Out of an abundance of caution, we have assigned this
upgrade an advisory:
https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
* Security
* Upgrade astral-tokio-tar to 0.5.6 to address a parsing
differential (#16387)
* Enhancements
* Add required environment marker example to hint (#16244)
* Fix typo in MissingTopLevel warning (#16351)
* Improve 403 Forbidden error message to indicate package may not
exist (#16353)
* Add a hint on uv pip install failure if the --system flag is
used to select an externally managed interpreter (#16318)
* Bug fixes
* Fix backtick escaping for PowerShell (#16307)
* Documentation
* Document metadata consistency expectation (#15683)
* Remove outdated aarch64 musl note (#16385)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=137
- update to 0.9.2
* Enhancements
* Log Python choice in uv init
* Fix pylock.toml config conflict error messages
* Avoid inferring check URLs for pyx in uv publish
* Add uv tool list --show-python
* Configuration
*
* Add UV_UPLOAD_HTTP_TIMEOUT and respect UV_HTTP_TIMEOUT in uploads
* Support UV_WORKING_DIRECTORY for setting --directory
* Bug fixes
* Allow missing Scripts directory
* Fix handling of Python requests with pre-releases in ranges
* Preserve comments on version bump
* Retry all HTTP/2 errors
* Treat deleted Windows registry keys as equivalent to missing ones
* Ignore pre-release Python versions when a patch version is requested
* Documentation
* Document why uv discards upper bounds on requires-python
* Document uv version environment variables were added in
* Add missing "added in" to new environment variables in reference
- update to 0.9.0:
* Enhancements
* Don't warn when a dependency is constrained by another dependency
* Bug fixes
* Fix uv python upgrade / install output when there is a no-op for one request
* Surface pinned-version hint when uv tool upgrade can’t move the tool
* Ban pre-release versions in uv python upgrade requests
* Fix uv python upgrade replacement of installed binaries on pre-release to stable
OBS-URL: https://build.opensuse.org/request/show/1310638
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=55
* Enhancements
* Don't warn when a dependency is constrained by another dependency
* Bug fixes
* Fix uv python upgrade / install output when there is a no-op for one request
* Surface pinned-version hint when uv tool upgrade can’t move the tool
* Ban pre-release versions in uv python upgrade requests
* Fix uv python upgrade replacement of installed binaries on pre-release to stable
* Documentation
* Update uv pip compile args in layout.md
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=130
- update to 0.8.24
* Enhancements
* Add UV_SKIP_WHEEL_FILENAME_CHECK to allow installing invalid wheels
* Emit a message on cache clean and prune when lock is held
* Add --force flag for uv cache prune
* Documentation
* Document transparent x86_64 emulation on aarch64
* Document why we ban URLs from index dependencies
* Fix rendering of _CONDA_ROOT in reference
* Fix example of bumping beta version without patch bump
* Bug fixes
* Avoid rejecting already-installed URL distributions with --no-sources
* Confirm that the directory name is a valid Python install key during managed check
* Ignore origin when comparing installed tools
* Make cache control lookups robust to username
* Re-order lock validation checks by severity
* Remove tracking of inferred dependency conflicts
* Respect --no-color on the CLI
* Deduplicate marker-specific dependencies in uv pip tree output
OBS-URL: https://build.opensuse.org/request/show/1309609
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=54
* Enhancements
* Add UV_SKIP_WHEEL_FILENAME_CHECK to allow installing invalid wheels
* Emit a message on cache clean and prune when lock is held
* Add --force flag for uv cache prune
* Documentation
* Document transparent x86_64 emulation on aarch64
* Document why we ban URLs from index dependencies
* Fix rendering of _CONDA_ROOT in reference
* Fix example of bumping beta version without patch bump
* Bug fixes
* Avoid rejecting already-installed URL distributions with --no-sources
* Confirm that the directory name is a valid Python install key during managed check
* Ignore origin when comparing installed tools
* Make cache control lookups robust to username
* Re-order lock validation checks by severity
* Remove tracking of inferred dependency conflicts
* Respect --no-color on the CLI
* Deduplicate marker-specific dependencies in uv pip tree output
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=128
- update 0.8.22
* Security
* Upgrade astral-tokio-tar to 0.5.5 which hardens tar archive extraction
* Preview features
* Add support for S3 request signing
* Allow upgrading pre-release versions of the same minor Python version
* Enhancements
* Refresh lockfile when --refresh is provided
* Add --force flag for uv cache clean
* Improve resolution errors with proxied packages
* Bug fixes
* Hide freethreaded+debug Python downloads in uv python list
* Retain the cache lock and temporary caches during uv run and uvx
* Documentation
* Add package level conflicts to the conflicting dependencies docs
* Document pyodide support
* Document support for free-threaded and debug Python versions
* Expand the contribution docs on issue selection
* Tweak title for viewing version in project guide
OBS-URL: https://build.opensuse.org/request/show/1307125
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=52
* Security
* Upgrade astral-tokio-tar to 0.5.5 which hardens tar archive extraction
* Preview features
* Add support for S3 request signing
* Allow upgrading pre-release versions of the same minor Python version
* Enhancements
* Refresh lockfile when --refresh is provided
* Add --force flag for uv cache clean
* Improve resolution errors with proxied packages
* Bug fixes
* Hide freethreaded+debug Python downloads in uv python list
* Retain the cache lock and temporary caches during uv run and uvx
* Documentation
* Add package level conflicts to the conflicting dependencies docs
* Document pyodide support
* Document support for free-threaded and debug Python versions
* Expand the contribution docs on issue selection
* Tweak title for viewing version in project guide
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=124
- update to 0.8.19
* Bug fixes
* Make uv cache clean parallel process safe
* Fix implied platform_machine marker for win_arm64 platform tag
- upate to 0.8.18
* Enhancements
* Add PyG packages to torch backend
* Add handling for unnamed conda environments in base environment detection
* Allow selection of debug build interpreters
* Improve uv init defaults for native build backend cache keys
* Error when pyproject.toml target does not exist for dependency groups
* Infer check URL from publish URL when known
* Support Gitlab CI/CD as a trusted publisher
* Add GraalPy 25.0.0 with support for Python 3.12
* Add --no-clear to uv venv to disable removal prompts
* Add conflict detection between --only-group and --extra flags
* Allow [project] to be missing from a pyproject.toml
* Always treat conda environments named base and root as base environments
* Improve log message when direct build for uv_build is skipped
* Log when the cache is disabled
* Show pyx organization name after authenticating
* Use _CONDA_ROOT to detect Conda base environments
* Include blake2b hash in uv publish upload form
* Fix misleading debug message when removing environments in uv sync
* Deprecations
* Deprecate tool.uv.dev-dependencies
* Preview features
* Propagate preview flag to client for native-auth feature
* Store native credentials for realms with the https scheme stripped
OBS-URL: https://build.opensuse.org/request/show/1306573
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=51
* Enhancements
* Add PyG packages to torch backend
* Add handling for unnamed conda environments in base environment detection
* Allow selection of debug build interpreters
* Improve uv init defaults for native build backend cache keys
* Error when pyproject.toml target does not exist for dependency groups
* Infer check URL from publish URL when known
* Support Gitlab CI/CD as a trusted publisher
* Add GraalPy 25.0.0 with support for Python 3.12
* Add --no-clear to uv venv to disable removal prompts
* Add conflict detection between --only-group and --extra flags
* Allow [project] to be missing from a pyproject.toml
* Always treat conda environments named base and root as base environments
* Improve log message when direct build for uv_build is skipped
* Log when the cache is disabled
* Show pyx organization name after authenticating
* Use _CONDA_ROOT to detect Conda base environments
* Include blake2b hash in uv publish upload form
* Fix misleading debug message when removing environments in uv sync
* Deprecations
* Deprecate tool.uv.dev-dependencies
* Preview features
* Propagate preview flag to client for native-auth feature
* Store native credentials for realms with the https scheme stripped
* Use the root index URL when retrieving credentials from the native store
* Bug fixes
* Fix uv sync --no-sources not switching from editable to registry installations
* Avoid display of an empty string when a path is the working directory
* Allow cached environment reuse with @latest
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=121
- update to 0.8.17
* Enhancements
* Improve error message for HTTP validation in auth services
* Respect PYX_API_URL when suggesting uv auth login on 401
* Add pyx as a supported PyTorch index URL
* Bug fixes
* Avoid initiating login flow for invalid API keys
* Do not search for a password for requests with a token attached already
* Filter pre-release Python versions in uv init --script
OBS-URL: https://build.opensuse.org/request/show/1304077
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=49
* Enhancements
* Improve error message for HTTP validation in auth services
* Respect PYX_API_URL when suggesting uv auth login on 401
* Add pyx as a supported PyTorch index URL
* Bug fixes
* Avoid initiating login flow for invalid API keys
* Do not search for a password for requests with a token attached already
* Filter pre-release Python versions in uv init --script
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=116
- update to 0.8.16
* Enhancements
* Allow --editable to override editable = false annotations
* Allow editable = false for workspace sources
* Show a dedicated error for virtual environments in source trees on build
* Support Android platform tags
* Support iOS platform tags
* Support scripts with inline metadata in --with-requirements and --requirements
* Preview features
* Support --no-project in uv format
* Allow uv format in unmanaged projects
* Bug fixes
* Avoid erroring when match-runtime target is optional
* Ban empty usernames and passwords in uv auth
* Error early for parent path in build backend
* Retry on IO errors during HTTP/2 streaming
* Support recursive requirements and constraints inclusion
* Use token store credentials for uv publish
* Fix virtual environment activation script compatibility with latest nushell
* Skip Python interpreters that cannot be queried with permission errors
* Documentation
* Clarify that uv auth commands take a URL
* Improve the CLI help for options that accept requirements files
* Adds example for caching for managed Python downloads in Docker builds
OBS-URL: https://build.opensuse.org/request/show/1303630
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=48
