Launch 0.12.0 · astral-sh/uv · GitHub

Outline construct programs by default with uv init (#19197)

Initiatives created with uv init now declare a construct system and are packaged by default. This was the default undertaking format all the best way again in v0.3, however we discovered that the usage of the hatchling construct system was complicated to newcomers and consequently dropped use of a construct system by default in v0.4. Since then, we have created our personal construct system (uv_build) with tight integration with uv and are excited to revive the default to a best-practice undertaking format.

Beforehand, uv init instance created an unpackaged format containing foremost.py and a pyproject.toml with no construct system. The undertaking may declare dependencies however was not itself put in into its digital surroundings.

Now, uv init instance defines a [build-system] utilizing uv_build, locations software supply code in src/instance, and features a [project.scripts] entry named instance. Defining a construct system permits the undertaking to be imported from checks or different code, put in as a dependency, and run as a command:

Present tasks are unaffected. Use uv init –no-package instance to create the earlier unpackaged format with no construct system.

See the undertaking creation documentation for extra particulars.

This stabilizes the packaged-init preview characteristic.

Reject unsupported supply distribution and wheel archive codecs (#18927)

PEP 625 requires supply distributions to make use of .tar.gz archives. Beforehand, uv additionally accepted legacy codecs similar to .tar.bz2 and .tar.xz. These codecs are actually rejected, together with when referenced by an present lockfile. Legacy .zip supply distributions stay supported for backwards compatibility.

Wheels and different ZIP archives can now not include entries compressed with bzip2, LZMA, or XZ. Entries should use the saved, DEFLATE, or zstd compression strategies.

Eradicating assist for unusual compression strategies reduces uv’s compression dependencies and the assault floor uncovered when processing untrusted packages.

You can not decide out of this habits. Should you rely on a legacy supply distribution that makes use of an unsupported format, we advocate rebuilding it as a .tar.gz archive and regenerating any lockfile containing references to the legacy archive.

Reject wheel recordsdata that would substitute the Python interpreter (#20748, #20749)

uv already rejected wheel entry factors named python, however case variants similar to Python have been nonetheless accepted. On case-insensitive filesystems, together with frequent macOS and Home windows setups, these entry factors may overwrite the digital surroundings’s interpreter.

Wheels may additionally place interpreter recordsdata of their .knowledge/scripts listing or in paths similar to .knowledge/knowledge/bin/python, bypassing the entry-point verify and changing the interpreter throughout set up.

uv now rejects case-insensitive variants of reserved interpreter names and wheel knowledge recordsdata that might be put in over an interpreter. This consists of names similar to Python, python.py, and Python.exe, together with different reserved interpreter names and their versioned variants.

You can not decide out of those checks. Rename conflicting entry factors or wheel knowledge recordsdata and rebuild the affected wheel.

Desire steady releases earlier than falling again to pre-releases (#19993)

A dependency can introduce a pre-release requirement after decision begins. uv beforehand required every package deal’s pre-release eligibility to be identified earlier than decision started: the default if-necessary-or-explicit mode allowed them for direct necessities that explicitly requested a pre-release, or for packages that solely revealed pre-releases.

This meant {that a} pre-release requirement found in a dependency’s metadata, e.g., instance>=2.0.0b1, would fail to resolve even when a appropriate pre-release existed. To resolve it, you had so as to add that dependency as a direct requirement or enable pre-releases throughout your total dependency graph.

The default mode is now if-necessary. uv tries steady candidates first and falls again to pre-releases when no steady candidate satisfies the energetic constraints. Like pip, uv now helps pre-release necessities found transitively, however can choose completely different variations than earlier uv releases when each steady and pre-release candidates can be found.

You possibly can decide out of computerized pre-release choice with –prerelease disallow. Alternatively, –prerelease enable considers pre-releases with out first preferring steady releases, and –prerelease specific solely permits them for direct necessities that point out a pre-release.

The previous if-necessary-or-explicit mode distinguished between explicitly requested pre-releases and packages with no steady releases. That distinction is pointless now that if-necessary handles each circumstances, together with transitive necessities. The previous title stays accessible as an alias however is deprecated and will likely be eliminated in a future launch.

Respect –require-hashes directives in necessities.txt (#19336)

Beforehand, uv pip set up and uv pip sync warned about –require-hashes inside a necessities.txt file however nonetheless put in dependencies with out checking their hashes. Now, the directive allows hash-checking mode, simply as if –require-hashes had been handed on the command line.

For instance, this necessities file is now not accepted as a result of the requirement is neither pinned nor hashed:

You can not decide out whereas the directive is current. Pin each requirement with == and supply its hash, or take away –require-hashes if hash checking just isn’t supposed.

Reject MD5-only hashes in hash-checking mode (#20758)

Beforehand, uv pip set up –require-hashes and uv pip sync –require-hashes accepted necessities whose solely accessible digest used MD5. MD5 just isn’t collision-resistant, so counting on it undermined installations that require hash verification and differed from pip’s habits.

Hash-checking mode now requires no less than one safe digest for each requirement. For instance, the next requirement is rejected except a safe hash, similar to SHA-256, can also be equipped:

A safe hash will be equipped immediately on the requirement or in an identical constraints file. Atypical hash verification with out –require-hashes continues to assist MD5.

You can not decide out whereas hash checking is required. Regenerate affected hashes with SHA-256 or one other supported safe hash.

Reject invalid pylock.toml recordsdata and artifacts (#20402, #20440, #20443)

uv now validates extra necessities from the pylock.toml specification:

The packages array have to be current. Beforehand, uv interpreted a lacking array as an empty lockfile, so uv pip sync may uninstall an surroundings as an alternative of rejecting malformed enter. An explicitly empty packages = [] array stays legitimate.
Lockfile filenames have to be pylock.toml or a single-name variant similar to pylock.dev.toml. Names similar to pylock..toml and pylock.foo.bar.toml are rejected.
If a wheel, supply distribution, or different artifact declares a measurement, the downloaded or cached artifact should match. Beforehand, an incorrect measurement was accepted when the hash was appropriate. Sizes reported by package deal indexes stay advisory.

You can not decide out of those checks. Regenerate malformed lockfiles, rename invalid filenames, and both appropriate or take away an incorrect elective measurement worth.

Honor specific certificates overrides even when no certificates will be loaded (#20741, #20767)

Beforehand, uv ignored SSL_CERT_FILE or SSL_CERT_DIR values that pointed to lacking or inaccessible paths, empty recordsdata or directories, or sources with out legitimate certificates. As an alternative, it fell again to its default belief roots, doubtlessly permitting HTTPS connections that the configured override was supposed to reject.

Now, any non-empty SSL_CERT_FILE or SSL_CERT_DIR worth replaces uv’s default certificates roots, even when no legitimate certificates will be loaded. In that case, HTTPS requests fail as a result of no certificates are trusted. This is applicable to package deal downloads and distant scripts, together with GitHub Gists.

Repair or unset the certificates override. Unsetting it restores the default belief retailer; empty environment-variable values proceed to be ignored.

Help pip-compatible –cert dealing with in uv pip (#20418)

The uv pip interface now accepts –cert , e.g.:

As in pip, the offered PEM bundle replaces all different certificates sources for that invocation, together with system certificates and SSL_CERT_FILE or SSL_CERT_DIR. This transformation has no impact except you cross –cert. Embrace the mandatory certificates authorities within the bundle.

–cert is barely supported by uv pip instructions; different uv instructions proceed to make use of their present certificates configuration.

Uncover tasks relative to the script handed to uv run (#20225)

Beforehand, uv run undertaking/script.py found its undertaking from the present listing, even when the script belonged to a different undertaking. uv now begins undertaking and workspace discovery from the script’s listing as an alternative.

For instance, working uv run other-project/script.py now makes use of other-project and its dependencies. This fixes scripts that beforehand failed as a result of their very own dependencies weren’t put in, however can choose a special surroundings than earlier than.

You possibly can decide out of script-relative discovery by choosing a undertaking explicitly, e.g., uv run –project . other-project/script.py.

This stabilizes the target-workspace-discovery preview characteristic.

Require –force earlier than clearing a listing that isn’t a digital surroundings (#20225)

uv venv –clear beforehand eliminated any present goal listing, even when it was not a digital surroundings. uv emitted a warning however nonetheless deleted the listing and its contents. Now, uv refuses to clear directories that don’t include a digital surroundings.

You possibly can decide out of this security verify by explicitly passing –force, e.g., uv venv –clear –force ./not-a-virtualenv.

This stabilizes the venv-safe-clear preview characteristic.

Reject –project when initializing a undertaking (#20225)

–project selects an present undertaking, so it’s not significant when initializing a brand new one. Beforehand, uv init –project instance warned and initialized instance anyway; if a positional path was additionally offered, –project was ignored.

This utilization is now an error. Use uv init instance to initialize a undertaking on the requested path, or uv init –directory instance to alter the working listing first.

This stabilizes the init-project-flag preview characteristic.

Reject lacking or invalid –project paths (#20225)

uv beforehand warned when –project referred to a lacking listing or a file apart from pyproject.toml, however then tried to proceed. This might produce complicated errors later or run in opposition to an unintended undertaking.

Now, uv run –project lacking python fails instantly as an alternative of continuous. You can not decide out of this habits. Create the listing first or choose an present undertaking. Passing –project path/to/pyproject.toml stays supported and selects the file’s dad or mum listing.

This stabilizes the project-directory-must-exist preview characteristic.

Skip distributions with non-normalized filenames when publishing (#20225)

Distribution filenames should use normalized package deal names and variations. For instance, a wheel for model 1.01.0 needs to be named example-1.1.0-py3-none-any.whl, not example-1.01.0-py3-none-any.whl.

Beforehand, uv publish warned about non-normalized filenames however nonetheless tried to add them. It now skips the affected wheels and supply distributions as an alternative.

You can not decide out of this habits. Rebuild distributions with normalized filenames earlier than publishing.

This stabilizes the publish-require-normalized preview characteristic.

Classify Conda environments named base and root by their paths (#20225)

Conda environments named base or root have been beforehand assumed to be the bottom Conda surroundings, even once they have been bizarre youngster environments. uv now acknowledges youngster Conda environments named base or root based mostly on their paths, because it already does for different names.

You possibly can decide out of computerized interpreter choice by requesting an interpreter explicitly with –python /path/to/python.

This stabilizes the special-conda-env-names preview characteristic.

Reject damaged .venv symlinks throughout surroundings discovery (#20433)

Beforehand, uv may ignore a damaged .venv symlink and proceed looking out dad or mum directories for one more digital surroundings. Because of this, instructions similar to uv pip set up may unexpectedly modify an unrelated ancestor surroundings.

uv now stops at a damaged .venv symlink and experiences its precise path. Errors encountered whereas studying digital surroundings metadata, together with permission failures, are additionally reported instantly as an alternative of being ignored.

You can not decide out of this habits. Restore or take away the damaged .venv symlink and proper any permissions that forestall uv from inspecting the surroundings.

Reinstall matching put in Python patch variations as an alternative of upgrading implicitly (#20659)

Earlier than Python upgrades have been supported, uv python set up 3.12 –reinstall doubled as a option to set up the newest Python 3.12 patch launch. Now that –upgrade is obtainable, –reinstall reinstalls the matching patch releases which might be already current.

For instance, if Python 3.12.6 and three.12.7 are put in, uv python set up 3.12 –reinstall reinstalls each variations as an alternative of putting in the newest accessible 3.12 launch.

You possibly can recuperate the earlier improve habits with uv python set up 3.12 –upgrade. Mix –upgrade –reinstall to reinstall solely the newest patch.

Require –upgrade-group to call an present dependency group (#18957)

Beforehand, uv lock –upgrade-group docs silently succeeded even when no docs dependency group existed. uv now validates the requested group in opposition to the undertaking, its workspace members, and workspace-level dependency teams.

You can not decide out of this habits. Right the group title or add it to [dependency-groups]. Legacy instrument.uv.dev-dependencies nonetheless satisfies –upgrade-group dev.

Resolve relative indexes and find-links in opposition to –directory (#20740)

The –directory possibility adjustments the listing during which uv operates. Beforehand, relative index and find-links paths equipped on the command line have been nonetheless resolved in opposition to the unique working listing.

uv now resolves –index, –default-index, –index-url, –extra-index-url, and –find-links relative to the listing chosen by –directory. For instance:

This now makes use of undertaking/packages as an alternative of ./packages within the unique working listing. Absolute paths and indexes loaded from configuration recordsdata are unaffected.

To protect the earlier goal, cross an absolute path or modify the relative path, e.g., –index ../packages.

Protect absolute paths offered to uv add (#18402)

uv add beforehand transformed each native dependency right into a project-relative path, even when the unique request used an absolute path or a literal file:// URL. It now preserves the type of the request in pyproject.toml and uv.lock:

Absolute paths make a undertaking much less transportable. Use a relative path to keep away from recording an absolute path. URLs containing expanded variables retain their present relative-path habits.

Take away older PyPy distributions which might be solely accessible as bzip2 archives (#20423)

Older PyPy patch releases which might be solely distributed as .tar.bz2 archives are now not accessible by means of uv python set up. These releases require unsupported bzip2 archives.

The most recent PyPy launch for every supported Python minor model is obtainable as a gzip-compressed archive and stays supported. For instance, uv python record 3.10 –all-versions nonetheless consists of the newest PyPy 3.10 launch, however older bzip2-only patch releases are omitted.

You can not decide out of this habits. Request a more moderen PyPy patch launch as an alternative.

Omit excluded-package feedback when annotations are disabled (#20085)

uv pip compile –no-annotate suppresses feedback describing the generated necessities file. Beforehand, a footer itemizing packages excluded with –unsafe-package was nonetheless included, regardless that annotations have been disabled. That footer is now omitted.

You possibly can recuperate the footer by eradicating –no-annotate.