- update to 0.9.5 (bsc#1252399, CVE-2025-62518)
This release contains an upgrade to astral-tokio-tar, which addresses
a vulnerability in tar extraction on malformed archives with
mismatching size information between the ustar header and PAX
extensions. While the astral-tokio-tar advisory has been graded as
"high" due its potential broader impact, the specific impact to uv is
low due to a lack of novel attacker capability. Specifically, uv only
processes tar archives from source distributions, which already
possess the capability for full arbitrary code execution by design,
meaning that an attacker gains no additional capabilities through
astral-tokio-tar.
Regardless, we take the hypothetical risk of parser differentials very
seriously. Out of an abundance of caution, we have assigned this
upgrade an advisory:
https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
* Security
* Upgrade astral-tokio-tar to 0.5.6 to address a parsing
differential (#16387)
* Enhancements
* Add required environment marker example to hint (#16244)
* Fix typo in MissingTopLevel warning (#16351)
* Improve 403 Forbidden error message to indicate package may not
exist (#16353)
* Add a hint on uv pip install failure if the --system flag is
used to select an externally managed interpreter (#16318)
* Bug fixes
* Fix backtick escaping for PowerShell (#16307)
* Documentation
* Document metadata consistency expectation (#15683)
* Remove outdated aarch64 musl note (#16385)
OBS-URL: https://build.opensuse.org/request/show/1313007
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=58
This release contains an upgrade to astral-tokio-tar, which addresses
a vulnerability in tar extraction on malformed archives with
mismatching size information between the ustar header and PAX
extensions. While the astral-tokio-tar advisory has been graded as
"high" due its potential broader impact, the specific impact to uv is
low due to a lack of novel attacker capability. Specifically, uv only
processes tar archives from source distributions, which already
possess the capability for full arbitrary code execution by design,
meaning that an attacker gains no additional capabilities through
astral-tokio-tar.
Regardless, we take the hypothetical risk of parser differentials very
seriously. Out of an abundance of caution, we have assigned this
upgrade an advisory:
https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
* Security
* Upgrade astral-tokio-tar to 0.5.6 to address a parsing
differential (#16387)
* Enhancements
* Add required environment marker example to hint (#16244)
* Fix typo in MissingTopLevel warning (#16351)
* Improve 403 Forbidden error message to indicate package may not
exist (#16353)
* Add a hint on uv pip install failure if the --system flag is
used to select an externally managed interpreter (#16318)
* Bug fixes
* Fix backtick escaping for PowerShell (#16307)
* Documentation
* Document metadata consistency expectation (#15683)
* Remove outdated aarch64 musl note (#16385)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=137
- update to 0.9.2
* Enhancements
* Log Python choice in uv init
* Fix pylock.toml config conflict error messages
* Avoid inferring check URLs for pyx in uv publish
* Add uv tool list --show-python
* Configuration
*
* Add UV_UPLOAD_HTTP_TIMEOUT and respect UV_HTTP_TIMEOUT in uploads
* Support UV_WORKING_DIRECTORY for setting --directory
* Bug fixes
* Allow missing Scripts directory
* Fix handling of Python requests with pre-releases in ranges
* Preserve comments on version bump
* Retry all HTTP/2 errors
* Treat deleted Windows registry keys as equivalent to missing ones
* Ignore pre-release Python versions when a patch version is requested
* Documentation
* Document why uv discards upper bounds on requires-python
* Document uv version environment variables were added in
* Add missing "added in" to new environment variables in reference
- update to 0.9.0:
* Enhancements
* Don't warn when a dependency is constrained by another dependency
* Bug fixes
* Fix uv python upgrade / install output when there is a no-op for one request
* Surface pinned-version hint when uv tool upgrade can’t move the tool
* Ban pre-release versions in uv python upgrade requests
* Fix uv python upgrade replacement of installed binaries on pre-release to stable
OBS-URL: https://build.opensuse.org/request/show/1310638
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=55
* Enhancements
* Don't warn when a dependency is constrained by another dependency
* Bug fixes
* Fix uv python upgrade / install output when there is a no-op for one request
* Surface pinned-version hint when uv tool upgrade can’t move the tool
* Ban pre-release versions in uv python upgrade requests
* Fix uv python upgrade replacement of installed binaries on pre-release to stable
* Documentation
* Update uv pip compile args in layout.md
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=130
- update to 0.8.24
* Enhancements
* Add UV_SKIP_WHEEL_FILENAME_CHECK to allow installing invalid wheels
* Emit a message on cache clean and prune when lock is held
* Add --force flag for uv cache prune
* Documentation
* Document transparent x86_64 emulation on aarch64
* Document why we ban URLs from index dependencies
* Fix rendering of _CONDA_ROOT in reference
* Fix example of bumping beta version without patch bump
* Bug fixes
* Avoid rejecting already-installed URL distributions with --no-sources
* Confirm that the directory name is a valid Python install key during managed check
* Ignore origin when comparing installed tools
* Make cache control lookups robust to username
* Re-order lock validation checks by severity
* Remove tracking of inferred dependency conflicts
* Respect --no-color on the CLI
* Deduplicate marker-specific dependencies in uv pip tree output
OBS-URL: https://build.opensuse.org/request/show/1309609
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=54
* Enhancements
* Add UV_SKIP_WHEEL_FILENAME_CHECK to allow installing invalid wheels
* Emit a message on cache clean and prune when lock is held
* Add --force flag for uv cache prune
* Documentation
* Document transparent x86_64 emulation on aarch64
* Document why we ban URLs from index dependencies
* Fix rendering of _CONDA_ROOT in reference
* Fix example of bumping beta version without patch bump
* Bug fixes
* Avoid rejecting already-installed URL distributions with --no-sources
* Confirm that the directory name is a valid Python install key during managed check
* Ignore origin when comparing installed tools
* Make cache control lookups robust to username
* Re-order lock validation checks by severity
* Remove tracking of inferred dependency conflicts
* Respect --no-color on the CLI
* Deduplicate marker-specific dependencies in uv pip tree output
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=128
- update 0.8.22
* Security
* Upgrade astral-tokio-tar to 0.5.5 which hardens tar archive extraction
* Preview features
* Add support for S3 request signing
* Allow upgrading pre-release versions of the same minor Python version
* Enhancements
* Refresh lockfile when --refresh is provided
* Add --force flag for uv cache clean
* Improve resolution errors with proxied packages
* Bug fixes
* Hide freethreaded+debug Python downloads in uv python list
* Retain the cache lock and temporary caches during uv run and uvx
* Documentation
* Add package level conflicts to the conflicting dependencies docs
* Document pyodide support
* Document support for free-threaded and debug Python versions
* Expand the contribution docs on issue selection
* Tweak title for viewing version in project guide
OBS-URL: https://build.opensuse.org/request/show/1307125
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=52
* Security
* Upgrade astral-tokio-tar to 0.5.5 which hardens tar archive extraction
* Preview features
* Add support for S3 request signing
* Allow upgrading pre-release versions of the same minor Python version
* Enhancements
* Refresh lockfile when --refresh is provided
* Add --force flag for uv cache clean
* Improve resolution errors with proxied packages
* Bug fixes
* Hide freethreaded+debug Python downloads in uv python list
* Retain the cache lock and temporary caches during uv run and uvx
* Documentation
* Add package level conflicts to the conflicting dependencies docs
* Document pyodide support
* Document support for free-threaded and debug Python versions
* Expand the contribution docs on issue selection
* Tweak title for viewing version in project guide
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=124
- update to 0.8.19
* Bug fixes
* Make uv cache clean parallel process safe
* Fix implied platform_machine marker for win_arm64 platform tag
- upate to 0.8.18
* Enhancements
* Add PyG packages to torch backend
* Add handling for unnamed conda environments in base environment detection
* Allow selection of debug build interpreters
* Improve uv init defaults for native build backend cache keys
* Error when pyproject.toml target does not exist for dependency groups
* Infer check URL from publish URL when known
* Support Gitlab CI/CD as a trusted publisher
* Add GraalPy 25.0.0 with support for Python 3.12
* Add --no-clear to uv venv to disable removal prompts
* Add conflict detection between --only-group and --extra flags
* Allow [project] to be missing from a pyproject.toml
* Always treat conda environments named base and root as base environments
* Improve log message when direct build for uv_build is skipped
* Log when the cache is disabled
* Show pyx organization name after authenticating
* Use _CONDA_ROOT to detect Conda base environments
* Include blake2b hash in uv publish upload form
* Fix misleading debug message when removing environments in uv sync
* Deprecations
* Deprecate tool.uv.dev-dependencies
* Preview features
* Propagate preview flag to client for native-auth feature
* Store native credentials for realms with the https scheme stripped
OBS-URL: https://build.opensuse.org/request/show/1306573
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=51
* Enhancements
* Add PyG packages to torch backend
* Add handling for unnamed conda environments in base environment detection
* Allow selection of debug build interpreters
* Improve uv init defaults for native build backend cache keys
* Error when pyproject.toml target does not exist for dependency groups
* Infer check URL from publish URL when known
* Support Gitlab CI/CD as a trusted publisher
* Add GraalPy 25.0.0 with support for Python 3.12
* Add --no-clear to uv venv to disable removal prompts
* Add conflict detection between --only-group and --extra flags
* Allow [project] to be missing from a pyproject.toml
* Always treat conda environments named base and root as base environments
* Improve log message when direct build for uv_build is skipped
* Log when the cache is disabled
* Show pyx organization name after authenticating
* Use _CONDA_ROOT to detect Conda base environments
* Include blake2b hash in uv publish upload form
* Fix misleading debug message when removing environments in uv sync
* Deprecations
* Deprecate tool.uv.dev-dependencies
* Preview features
* Propagate preview flag to client for native-auth feature
* Store native credentials for realms with the https scheme stripped
* Use the root index URL when retrieving credentials from the native store
* Bug fixes
* Fix uv sync --no-sources not switching from editable to registry installations
* Avoid display of an empty string when a path is the working directory
* Allow cached environment reuse with @latest
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=121
- update to 0.8.17
* Enhancements
* Improve error message for HTTP validation in auth services
* Respect PYX_API_URL when suggesting uv auth login on 401
* Add pyx as a supported PyTorch index URL
* Bug fixes
* Avoid initiating login flow for invalid API keys
* Do not search for a password for requests with a token attached already
* Filter pre-release Python versions in uv init --script
OBS-URL: https://build.opensuse.org/request/show/1304077
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=49
* Enhancements
* Improve error message for HTTP validation in auth services
* Respect PYX_API_URL when suggesting uv auth login on 401
* Add pyx as a supported PyTorch index URL
* Bug fixes
* Avoid initiating login flow for invalid API keys
* Do not search for a password for requests with a token attached already
* Filter pre-release Python versions in uv init --script
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=116
- update to 0.8.16
* Enhancements
* Allow --editable to override editable = false annotations
* Allow editable = false for workspace sources
* Show a dedicated error for virtual environments in source trees on build
* Support Android platform tags
* Support iOS platform tags
* Support scripts with inline metadata in --with-requirements and --requirements
* Preview features
* Support --no-project in uv format
* Allow uv format in unmanaged projects
* Bug fixes
* Avoid erroring when match-runtime target is optional
* Ban empty usernames and passwords in uv auth
* Error early for parent path in build backend
* Retry on IO errors during HTTP/2 streaming
* Support recursive requirements and constraints inclusion
* Use token store credentials for uv publish
* Fix virtual environment activation script compatibility with latest nushell
* Skip Python interpreters that cannot be queried with permission errors
* Documentation
* Clarify that uv auth commands take a URL
* Improve the CLI help for options that accept requirements files
* Adds example for caching for managed Python downloads in Docker builds
OBS-URL: https://build.opensuse.org/request/show/1303630
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=48
* Enhancements
* Allow --editable to override editable = false annotations
* Allow editable = false for workspace sources
* Show a dedicated error for virtual environments in source trees on build
* Support Android platform tags
* Support iOS platform tags
* Support scripts with inline metadata in --with-requirements and --requirements
* Preview features
* Support --no-project in uv format
* Allow uv format in unmanaged projects
* Bug fixes
* Avoid erroring when match-runtime target is optional
* Ban empty usernames and passwords in uv auth
* Error early for parent path in build backend
* Retry on IO errors during HTTP/2 streaming
* Support recursive requirements and constraints inclusion
* Use token store credentials for uv publish
* Fix virtual environment activation script compatibility with latest nushell
* Skip Python interpreters that cannot be queried with permission errors
* Documentation
* Clarify that uv auth commands take a URL
* Improve the CLI help for options that accept requirements files
* Adds example for caching for managed Python downloads in Docker builds
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=114
- update to 0.8.14
* Enhancements
* Add --python-platform to uv pip check
* Add an environment variable for UV_ISOLATED
* Add logging to the uv build backend
* Allow more trailing null bytes in zip files
* Allow pinning managed Python versions to specific build versions
* Cache PyTorch wheels by default
* Reject already-installed wheels that don't match the target platform
* Add --no-install-local option to uv sync, uv add and uv export
* Include cycle error message in uv pip CLI
* Preview features
* Fix format of {version} on uv format failure
* Lock during installs in uv format to prevent races
* Respect --project in uv format
* Run uv format in the project root
* Configuration
* Add file-to-CLI overrides for build isolation configuration
* Add file-to-CLI overrides for reinstall configuration
* Performance
* Cache WHEEL and METADATA reads in installed distributions
* Bug fixes
* Avoid erroring when creating venv in current working directory
* Avoid introducing unnecessary system dependency on CUDA
* Clear discovered site packages when creating virtual environment
* Read index credentials from the environment during uv publish checks
* Refuse to remove non-virtual environments in uv venv
* Stop setting CLICOLOR_FORCE=1 when calling build backends
* Support file or directory removal for Windows symlinks
* Documentation
OBS-URL: https://build.opensuse.org/request/show/1301842
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=45
* Enhancements
* Add --python-platform to uv pip check
* Add an environment variable for UV_ISOLATED
* Add logging to the uv build backend
* Allow more trailing null bytes in zip files
* Allow pinning managed Python versions to specific build versions
* Cache PyTorch wheels by default
* Reject already-installed wheels that don't match the target platform
* Add --no-install-local option to uv sync, uv add and uv export
* Include cycle error message in uv pip CLI
* Preview features
* Fix format of {version} on uv format failure
* Lock during installs in uv format to prevent races
* Respect --project in uv format
* Run uv format in the project root
* Configuration
* Add file-to-CLI overrides for build isolation configuration
* Add file-to-CLI overrides for reinstall configuration
* Performance
* Cache WHEEL and METADATA reads in installed distributions
* Bug fixes
* Avoid erroring when creating venv in current working directory
* Avoid introducing unnecessary system dependency on CUDA
* Clear discovered site packages when creating virtual environment
* Read index credentials from the environment during uv publish checks
* Refuse to remove non-virtual environments in uv venv
* Stop setting CLICOLOR_FORCE=1 when calling build backends
* Support file or directory removal for Windows symlinks
* Documentation
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=108
- update to 0.8.13
* Enhancements
* Add --no-install-* arguments to uv add
* Initialize Git prior to reading author in uv init
* Add CUDA 129 to available torch backends
* Update Pyodide to 0.28.2
* Preview features
* Add an experimental uv format command
* Allow version specifiers in extra-build-dependencies if match-runtime is explicitly false
* Bug fixes
* Add triton to torch-backend manifest
* Avoid panicking when resolver returns stale distributions
* Fix uv_build wheel hashes
* Treat --upgrade-package on the command-line as overriding upgrade = false in configuration
OBS-URL: https://build.opensuse.org/request/show/1300990
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=44
* Enhancements
* Add --no-install-* arguments to uv add
* Initialize Git prior to reading author in uv init
* Add CUDA 129 to available torch backends
* Update Pyodide to 0.28.2
* Preview features
* Add an experimental uv format command
* Allow version specifiers in extra-build-dependencies if match-runtime is explicitly false
* Bug fixes
* Add triton to torch-backend manifest
* Avoid panicking when resolver returns stale distributions
* Fix uv_build wheel hashes
* Treat --upgrade-package on the command-line as overriding upgrade = false in configuration
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=106
- update to 0.8.12
* Enhancements
* Add an aarch64-pc-windows-msvc target for python-platform
* Add fallback parent process detection to uv tool update-shell
* Install non-build-isolation packages in a second phase
* Add hint when virtual environments are included in source distributions
* Add Docker images derived from buildpack-deps:trixie, debian:trixie-slim, alpine:3.22
* Bug fixes
* Reject already-installed wheels built with outdated settings
* Skip interpreters that are not found on query
* Handle dotted package names in script path resolution
* Reject match-runtime = true for dynamic packages
* Documentation
* Document improvements to build-isolation setups
* Fix reference documentation recommendation to use uv cache clean instead of clear
OBS-URL: https://build.opensuse.org/request/show/1300468
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=43
- update to 0.8.11
* Enhancements
* Add extra-build-dependencies hint for any missing module on build failure
* Make 'v' prefix cyan in overlap warnings
* Bug fixes
* Fix missing uv version in extended Docker image tags
* Persist cache info when re-installing cached wheels
* Rust API
*Allow passing custom reqwest clients to RegistryClient
- update to 0.8.10
* Enhancements
* Allow Python requests with missing segments, e.g., just aarch64
* Preview
* Move warnings for conflicting modules into preview
OBS-URL: https://build.opensuse.org/request/show/1299855
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=42
* Enhancements
* Add extra-build-dependencies hint for any missing module on build failure
* Make 'v' prefix cyan in overlap warnings
* Bug fixes
* Fix missing uv version in extended Docker image tags
* Persist cache info when re-installing cached wheels
* Rust API
*Allow passing custom reqwest clients to RegistryClient
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-uv?expand=0&rev=102
oid sha256:1899e84a48e0c45a8120149c6fd9155ac52e6220029b2ac41e29dec2807e6791
size 58852134
oid sha256:e7450717b1b2bd0f0918060ed77a8d654a6da002f3d0e066b1c971f0c7a13366
size 65628991
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
