Release Notes

Python

• Upgrade SQLite 3.50.4 in CPython builds for CVE-2025-6965 (see also python/cpython#137134)

Enhancements

• Add uv auth commands for credential management (#15570)
• Add pyx support to uv auth commands (#15636)
• Add uv tree --show-sizes to show package sizes (#15531)
• Add --python-platform riscv64-unknown-linux (#15630)
• Add --python-platform to uv run and uv tool (#15515)
• Add uv publish --dry-run (#15638)
• Add zstandard support for wheels (#15645)
• Allow registries to pre-provide core metadata (#15644)
• Retry streaming Python and binary download errors (#15567)

Bug fixes

• Fix settings rendering for extra-build-dependencies (#15622)
• Skip non-existent directories in bytecode compilation (#15608)

Error messages

• Add error trace to invalid package format (#15626)

Install uv 0.8.15

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.15/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.15/uv-installer.ps1 | iex"

Download uv 0.8.15

Release Notes

Python

• Add managed CPython distributions for aarch64 musl

Enhancements

• Add --python-platform to uv pip check (#15486)
• Add an environment variable for UV_ISOLATED (#15428)
• Add logging to the uv build backend (#15533)
• Allow more trailing null bytes in zip files (#15452)
• Allow pinning managed Python versions to specific build versions (#15314)
• Cache PyTorch wheels by default (#15481)
• Reject already-installed wheels that don't match the target platform (#15484)
• Add --no-install-local option to uv sync, uv add and uv export (#15328)
• Include cycle error message in uv pip CLI (#15453)

Preview features

• Fix format of {version} on uv format failure (#15527)
• Lock during installs in uv format to prevent races (#15551)
• Respect --project in uv format (#15438)
• Run uv format in the project root (#15440)

Configuration

• Add file-to-CLI overrides for build isolation configuration (#15437)
• Add file-to-CLI overrides for reinstall configuration (#15426)

Performance

• Cache WHEEL and METADATA reads in installed distributions (#15489)

Bug fixes

• Avoid erroring when creating venv in current working directory (#15537)
• Avoid introducing unnecessary system dependency on CUDA (#15449)
• Clear discovered site packages when creating virtual environment (#15522)
• Read index credentials from the environment during uv publish checks (#15545)
• Refuse to remove non-virtual environments in uv venv (#15538)
• Stop setting CLICOLOR_FORCE=1 when calling build backends (#15472)
• Support file or directory removal for Windows symlinks (#15543)

Documentation

• Fix GitHub guide highlight lines (#15443)
• Move Resolver to new Internals section in the Reference (#15465)
• Split the "Authentication" page into sections (#15575)
• Update uninstall docs to mention uvw.exe needs to be removed (#15536)

Install uv 0.8.14

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.14/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.14/uv-installer.ps1 | iex"

Download uv 0.8.14

Release Notes

Enhancements

• Add --no-install-* arguments to uv add (#15375)
• Initialize Git prior to reading author in uv init (#15377)
• Add CUDA 129 to available torch backends (#15416)
• Update Pyodide to 0.28.2 (#15385)

Preview features

• Add an experimental uv format command (#15017)
• Allow version specifiers in extra-build-dependencies if match-runtime is explicitly false (#15420)

Bug fixes

• Add triton to torch-backend manifest (#15405)
• Avoid panicking when resolver returns stale distributions (#15389)
• Fix uv_build wheel hashes (#15400)
• Treat --upgrade-package on the command-line as overriding upgrade = false in configuration (#15395)
• Restore DockerHub publishing (#15381)

Install uv 0.8.13

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.13/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.13/uv-installer.ps1 | iex"

Download uv 0.8.13

Release Notes

Python

• Add 3.13.7
• Improve performance of zstd in Python 3.14

See the python-build-standalone release notes for details.

Enhancements

• Add an aarch64-pc-windows-msvc target for python-platform (#15347)
• Add fallback parent process detection to uv tool update-shell (#15356)
• Install non-build-isolation packages in a second phase (#15306)
• Add hint when virtual environments are included in source distributions (#15202)
• Add Docker images derived from buildpack-deps:trixie, debian:trixie-slim, alpine:3.22 (#15351)

Bug fixes

• Reject already-installed wheels built with outdated settings (#15289)
• Skip interpreters that are not found on query (#15315)
• Handle dotted package names in script path resolution (#15300)
• Reject match-runtime = true for dynamic packages (#15292)

Documentation

• Document improvements to build-isolation setups (#15326)
• Fix reference documentation recommendation to use uv cache clean instead of clear (#15313)

Install uv 0.8.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.12/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.12/uv-installer.ps1 | iex"

Download uv 0.8.12

Release Notes

Python

• Add Python 3.14.0rc2
• Update Pyodide to 0.28.1

Enhancements

• Add Debian 13 trixie to published Docker images (#15269)
• Add extra-build-dependencies hint for any missing module on build failure (#15252)
• Make 'v' prefix cyan in overlap warnings (#15259)

Bug fixes

• Fix missing uv version in extended Docker image tags (#15263)
• Persist cache info when re-installing cached wheels (#15274)

Rust API

• Allow passing custom reqwest clients to RegistryClient (#15281)

Install uv 0.8.11

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.11/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.11/uv-installer.ps1 | iex"

Download uv 0.8.11

Release Notes

Python

• Add support for installing Pyodide versions (#14518)

Enhancements

• Allow Python requests with missing segments, e.g., just aarch64 (#14399)

Preview

• Move warnings for conflicting modules into preview (#15253)

Install uv 0.8.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.10/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.10/uv-installer.ps1 | iex"

Download uv 0.8.10

Release Notes

Enhancements

• Add --reinstall flag to uv python upgrade (#15194)

Bug fixes

• Include build settings in cache key for registry source distribution lookups (#15225)
• Avoid creating bin links on uv python upgrade if they don't already exist (#15192)
• Respect system proxies on macOS and Windows (#15221)

Documentation

• Add the 3.14 classifier (#15187)

Install uv 0.8.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.9/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.9/uv-installer.ps1 | iex"

Download uv 0.8.9

Release Notes

Bug fixes

• Fix find_uv_bin compatibility with Python <3.10 (#15177)

Install uv 0.8.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.8/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.8/uv-installer.ps1 | iex"

Download uv 0.8.8

Release Notes

Python

• On Mac/Linux, libtcl, libtk, and _tkinter are built as separate shared objects, which fixes matplotlib's tkagg backend (the default on Linux), Pillow's PIL.ImageTk library, and other extension modules that need to use libtcl/libtk directly.
• Tix is no longer provided on Linux. This is a deprecated Tk extension that appears to have been previously broken.

See the python-build-standalone release notes for details.

Enhancements

• Do not update uv.lock when using --isolated (#15154)
• Add support for --prefix and --with installations in find_uv_bin (#14184)
• Add support for discovering base prefix installations in find_uv_bin (#14181)
• Improve error messages in find_uv_bin (#14182)
• Warn when two packages write to the same module (#13437)

Preview features

• Add support for package-level conflicts in workspaces (#14906)

Configuration

• Add UV_DEV and UV_NO_DEV environment variables (for --dev and --no-dev) (#15010)

Bug fixes

• Fix regression where --require-hashes applied to build dependencies in uv pip install (#15153)
• Ignore GraalPy devtags (#15013)
• Include all site packages directories in ephemeral environment overlays (#15121)
• Search in the user scheme scripts directory last in find_uv_bin (#14191)

Documentation

• Add missing periods (.) to list elements in Features docs page (#15138)

Install uv 0.8.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.7/uv-installer.ps1 | iex"

Download uv 0.8.7

Release Notes

This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parsers (CVE-2025-54368).

Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs.

Thanks to a triage effort with the Python Security Response Team and PyPI maintainers, we were able to determine that these differentials were not exploited via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload.

Although the practical risk of exploitation is low, we take the hypothetical risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this advisory a CVE identifier and have given it a "moderate" severity suggestion.

These changes have been validated against the top 15,000 PyPI packages; however, it's plausible that a non-malicious ZIP could be falsely rejected with this additional hardening. As an escape hatch, users who do encounter breaking changes can enable UV_INSECURE_NO_ZIP_VALIDATION to restore the previous behavior. If you encounter such a rejection, please file an issue in uv and to the upstream package.

For additional information, please refer to the following blog posts:

• Astral: uv security advisory: ZIP payload obfuscation
• PyPI: Preventing ZIP parser confusion attacks on Python package installers

Security

• Harden ZIP streaming to reject repeated entries and other malformed ZIP files (#15136)

Python

• Add CPython 3.13.6

Configuration

• Add support for per-project build-time environment variables (#15095)

Bug fixes

• Avoid invalid simplification with conflict markers (#15041)
• Respect UV_HTTP_RETRIES in uv publish (#15106)
• Support UV_NO_EDITABLE where --no-editable is supported (#15107)
• Upgrade cargo-dist to add UV_INSTALLER_URL to PowerShell installer (#15114)
• Upgrade h2 again to avoid too_many_internal_resets errors (#15111)
• Consider pythonw when copying entry points in uv run (#15134)

Documentation

• Ensure symlink warning is shown (#15126)

Install uv 0.8.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.6/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.6/uv-installer.ps1 | iex"

Download uv 0.8.6