Uv

Latest version: v0.5.9

Safety actively analyzes 688924 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 2 of 22

0.5.3

This release includes support for conflicting optional dependencies and dependency groups in the uv resolver, including the ability to specify dependency sources (like index assignment) on a per-extra or per-group basis.

For example, you can now select CPU-only vs. GPU-enabled PyTorch builds at runtime by defining conflicting extras in a `pyproject.toml`, and assigning different extras to different PyTorch indexes:

toml
[project]
name = "project"

0.5.2

Enhancements

- Hide `--no-system` from `uv pip tree` CLI ([9040](https://github.com/astral-sh/uv/pull/9040))
- Allow configuration of Python and PyPy install mirrors in `uv.toml` ([8695](https://github.com/astral-sh/uv/pull/8695))
- Allow passing Python download mirrors to `uv python install` ([8695](https://github.com/astral-sh/uv/pull/8695))
- Add support for specifying conflicting extras and dependency groups ([8976](https://github.com/astral-sh/uv/pull/8976), [#9096](https://github.com/astral-sh/uv/pull/9096))
- Consistent colon usage in build failure errors ([8994](https://github.com/astral-sh/uv/pull/8994))
- Show full derivation chain when encountering build failures ([9108](https://github.com/astral-sh/uv/pull/9108))
- Show link we failed on parsing index pages ([9118](https://github.com/astral-sh/uv/pull/9118))
- Remove duplicate log when searching for interpreters ([9092](https://github.com/astral-sh/uv/pull/9092))
- Update uv development status classifier to "Stable" on PyPI ([8943](https://github.com/astral-sh/uv/pull/8943))
- Use rich diagnostic formatting for early build failures ([9041](https://github.com/astral-sh/uv/pull/9041))
- Use rich diagnostic formatting for install failures ([9043](https://github.com/astral-sh/uv/pull/9043))

Performance

- Avoid retraversing filesystem when testing exact glob matches ([9022](https://github.com/astral-sh/uv/pull/9022))

Bug fixes

- Allow `--no-build` to validate lock ([9024](https://github.com/astral-sh/uv/pull/9024))
- Allow default indexes to be marked as explicit ([8990](https://github.com/astral-sh/uv/pull/8990))
- Avoid creating `.venv` in `uv add --frozen` and `uv add --no-sync` ([8980](https://github.com/astral-sh/uv/pull/8980))
- Avoid duplicating first-entry comments in `uv add` ([9109](https://github.com/astral-sh/uv/pull/9109))
- Defer reporting of build failures in resolver ([9098](https://github.com/astral-sh/uv/pull/9098))
- Fix references to `--resolution-strategy` in error message output ([8971](https://github.com/astral-sh/uv/pull/8971))
- Ignore virtual environments in parent directories when choosing Python version for new projects ([9075](https://github.com/astral-sh/uv/pull/9075))
- Forward SIGTERM to child processes in `uv run` ([8933](https://github.com/astral-sh/uv/pull/8933))
- Prefer Python executable names that match the request over default names ([9066](https://github.com/astral-sh/uv/pull/9066))
- Prefer compatible to incompatible distributions when packages exist on multiple indexes ([8961](https://github.com/astral-sh/uv/pull/8961))
- Publish: Ignore non-matching files ([8986](https://github.com/astral-sh/uv/pull/8986))
- Revert `uv.lock` changes when `uv add` fails ([9030](https://github.com/astral-sh/uv/pull/9030))
- Show file extensions on available commands when not `.exe` ([9099](https://github.com/astral-sh/uv/pull/9099))
- Sort by name, then specifiers in `uv add` ([9097](https://github.com/astral-sh/uv/pull/9097))
- Split after specifiers in `--with` requirements ([9089](https://github.com/astral-sh/uv/pull/9089))
- Support multiple extras in universal pip compile output ([8960](https://github.com/astral-sh/uv/pull/8960))

Preview features

- Build backend: Add tests for source tree -> source dist -> wheel conversions ([9091](https://github.com/astral-sh/uv/pull/9091))
- Build backend: Switch to custom `glob-walkdir` implementation ([9013](https://github.com/astral-sh/uv/pull/9013))
- Build backend: Add minimal wheel settings ([9085](https://github.com/astral-sh/uv/pull/9085))

Documentation

- Add wget instructions for systems without curl ([8630](https://github.com/astral-sh/uv/pull/8630))
- Fix `.env` file example in docs ([9064](https://github.com/astral-sh/uv/pull/9064))
- Fix reference to `--resolution` in docs ([8968](https://github.com/astral-sh/uv/pull/8968))
- Fix typo in GitLab integration docs ([9047](https://github.com/astral-sh/uv/pull/9047))
- Update format of environment variable reference ([9018](https://github.com/astral-sh/uv/pull/9018))
- Use Python syntax for `value_type` consistently ([9017](https://github.com/astral-sh/uv/pull/9017))
- Use `[[index]]` API in configuration example ([9065](https://github.com/astral-sh/uv/pull/9065))
- Mention how to use extras ([8972](https://github.com/astral-sh/uv/pull/8972))
- Add some words about specifying conflicting extras/groups ([9120](https://github.com/astral-sh/uv/pull/9120))

0.5.1

Enhancements

- Allow installation of manylinux wheels on `riscv64` ([8934](https://github.com/astral-sh/uv/pull/8934))

Bug fixes

- Build source distributions at top-level of cache ([8905](https://github.com/astral-sh/uv/pull/8905))
- Allow non-registry dependencies in `uv pip list --outdated` ([8939](https://github.com/astral-sh/uv/pull/8939))
- Compute superset of existing and required hashes when healing cache ([8955](https://github.com/astral-sh/uv/pull/8955))
- Enable uv to replace and delete itself on Windows ([8914](https://github.com/astral-sh/uv/pull/8914))
- Remove source distribution filename from cache ([8907](https://github.com/astral-sh/uv/pull/8907))
- Respect `--index-url` in `uv pip list` ([8942](https://github.com/astral-sh/uv/pull/8942))
- Respect comma-separated extras in `--with` ([8946](https://github.com/astral-sh/uv/pull/8946))

Documentation

- Add uninstall note for previous versions ([8937](https://github.com/astral-sh/uv/pull/8937))
- Remove some missed references to `~/.cargo/bin` ([8936](https://github.com/astral-sh/uv/pull/8936))
- Split README's install code block into 3 ([8853](https://github.com/astral-sh/uv/pull/8853))

0.5.0

Since the launch of Python version, project, and tool management capabilities back in August, we've seen extraordinary adoption of uv. We've been iterating rapidly: adding new features, fixing bugs, and improving the user experience. Despite moving quickly, stability and compatibility have been a major focus — we've made thirty releases since our last breaking change. Consequently, we've accumulated various changes that improve correctness and user experience, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. We expect most users to be able to upgrade without making changes.

Breaking

- **Use base executable to set virtualenv Python path** ([8481](https://github.com/astral-sh/uv/pull/8481))

Previously, uv canonicalized the path to the Python executable when setting the Python path in created virtual environments. This behavior had several undesirable effects: it would bypass stabilized version directories (as constructed by Homebrew) and it was not consistent with the Python standard library's behavior. Now, uv uses the `sys._base_executable` path.
- **Use XDG (i.e. `~/.local/bin`) instead of the Cargo home directory in the installer** ([8420](https://github.com/astral-sh/uv/pull/8420))

Previously, uv's installer used `$CARGO_HOME` or `~/.cargo/bin` for its target install directory. It's been a longstanding complaint that uv uses this directory, as there's no relationship to Cargo. Now, uv will be installed into `$XDG_BIN_HOME`, `$XDG_DATA_HOME/../bin`, or `~/.local/bin` (in that order). Note that `$UV_INSTALL_DIR` can always be used to override the target directory.
- **Discover and respect `.python-version` files in parent directories** ([6370](https://github.com/astral-sh/uv/pull/6370))

Previously, uv only read `.python-version` files from the working directory. Now, uv will check parent directories for `.python-version` files; however uv will not search for `.python-version` files beyond project boundaries. The new behavior is better aligned with that of `pyenv` and Rye.
- **Error when disallowed settings are defined in `uv.toml`** ([8550](https://github.com/astral-sh/uv/pull/8550))

Some settings can only be defined in the `pyproject.toml`. Previously, uv would ignore these settings when present in the `uv.toml`. Now, uv will error to avoid confusion about why the settings are not respected.
- **Implement PEP 440-compliant local version semantics** ([8797](https://github.com/astral-sh/uv/pull/8797))

Previously, uv's implementation of local versions (e.g. `2.0+cpu`) was not compliant with the specification due to the technical complexity of implementing the local version semantics in the PubGrub algorithm. Thanks to the work of ericmarkmartin, uv now has a spec-compliant implementation. Namely, uv will now allow a request for `torch==2.1.0` to install `torch2.1.0+cpu` regardless of whether `torch2.1.0` (without a local tag) actually exists.
- **Treat the base Conda environment as a system environment** ([7691](https://github.com/astral-sh/uv/pull/7691))

Previously, uv would not distinguish between the base and other Conda environments. Now, uv uses `CONDA_DEFAULT_ENV` and the names `base` and `default` to determine if an environment active via `CONDA_PREFIX` is the base environment. If the base environment is active, the `--system` flag must be used to mutate it.
- **Do not allow pre-releases when the `!=` operator is used** ([7974](https://github.com/astral-sh/uv/pull/7974))

Previously, uv would use the presence of a pre-release specifier in a version specifier as an opt-in to allow pre-release versions during resolution. The new behavior does not allow pre-releases when an inequals operator is used, e.g., `!= 2.0a1`.
- **Prefer `USERPROFILE` over `FOLDERID_Profile` when selecting a home directory on Windows** ([8048](https://github.com/astral-sh/uv/pull/8048))

This change is a side-effect of switching from the `directories` crate to `etcetera` for determining canonical system paths. If `USERPROFILE` is not set, the behavior will be unchanged.
- **Improve interactions between color environment variables and CLI options** ([8215](https://github.com/astral-sh/uv/pull/8215))

Previously, uv would respect the `FORCE_COLOR` and `NO_COLOR` environment variables over the `--color` flag. Now, when the `--color` flag is explicitly provided, uv will respect it over the environment variables.
- **Make `allow-insecure-host` a global option** ([8476](https://github.com/astral-sh/uv/pull/8476))

Previously, this option was only available in some parts of uv. Now, `--allow-insecure-host` can be provided to any command. For consistency, the `allow-insecure-host` setting has been removed from the `[tool.uv.pip]` configuration in favor of `[tool.uv]`.
- **Only write `.python-version` files during `uv init` for workspace members if the version differs** ([8897](https://github.com/astral-sh/uv/pull/8897))

Previously, uv would create a `.python-version` file for workspace members during `uv init`. Now, uv will only do so if the version differs from the `.python-version` file in the workspace root since uv will respect `.python-version` files in parent directories.

Enhancements

- Add `uv tree --outdated` ([8893](https://github.com/astral-sh/uv/pull/8893))
- Add armv8l alias for armv7l to support arm 32-bit compatibility mode ([8881](https://github.com/astral-sh/uv/pull/8881))
- Add support for `pip list --outdated` ([8872](https://github.com/astral-sh/uv/pull/8872))
- Allow semicolons directly after direct URLs ([8836](https://github.com/astral-sh/uv/pull/8836))
- Enable support for arbitrary git transports ([8769](https://github.com/astral-sh/uv/pull/8769))
- Improve Python discovery source messages ([8890](https://github.com/astral-sh/uv/pull/8890))
- Show dedicated error for trailing `;` on URL and path requirements ([8835](https://github.com/astral-sh/uv/pull/8835))
- Add progress bar for `uv cache clean` ([8857](https://github.com/astral-sh/uv/pull/8857))
- Warn on failure to query system configuration file ([8829](https://github.com/astral-sh/uv/pull/8829))

Preview features

- Add support for building basic source distributions with the experimental uv build backend ([8886](https://github.com/astral-sh/uv/pull/8886))

Bug fixes

- Respect dynamic version updates in `uv lock` ([8867](https://github.com/astral-sh/uv/pull/8867))
- Respect fork markers in `--resolution-mode=lowest-direct` ([8839](https://github.com/astral-sh/uv/pull/8839))

Documentation

- Add further examples of git+https support ([8841](https://github.com/astral-sh/uv/pull/8841))
- Add installer variables to environment reference ([8874](https://github.com/astral-sh/uv/pull/8874))
- Add note on private classifier ([8783](https://github.com/astral-sh/uv/pull/8783))
- Update pip-and-uv strictness example ([8822](https://github.com/astral-sh/uv/pull/8822))
- Fix `uv python install` docs to use an existing PyPy version ([8845](https://github.com/astral-sh/uv/pull/8845))
- Document how to mimic `--verbose` with `RUST_LOG` ([8858](https://github.com/astral-sh/uv/pull/8858))

0.4.30

Enhancements

- Add support for `.env` and custom env files in `uv run` ([8811](https://github.com/astral-sh/uv/pull/8811))
- Add support for `--all-packages` in `uv run`, `uv sync`, and `uv export` ([8742](https://github.com/astral-sh/uv/pull/8742), [#8741](https://github.com/astral-sh/uv/pull/8741), [#8739](https://github.com/astral-sh/uv/pull/8739))
- Allow use of `--frozen` with `--all-packages` in `uv sync` and `uv export` ([8760](https://github.com/astral-sh/uv/pull/8760))
- Show full error chain on tool upgrade failures ([8753](https://github.com/astral-sh/uv/pull/8753))
- Add `--check-url` to `uv publish` to check for existing distributions during upload ([8531](https://github.com/astral-sh/uv/pull/8531))
- Suggest using `--check-url` when `--skip-existing` is used ([8803](https://github.com/astral-sh/uv/pull/8803))

Bug fixes

- Allow incompatible `requires-python` for source distributions with static metadata ([8768](https://github.com/astral-sh/uv/pull/8768))
- Allow managed downloads with `--python-preference system` ([8808](https://github.com/astral-sh/uv/pull/8808))
- Avoid error for `--group` defined in non-root workspace member ([8734](https://github.com/astral-sh/uv/pull/8734))
- Avoid showing dependency group annotations on workspace members in tree ([8730](https://github.com/astral-sh/uv/pull/8730))
- Do not error when the Python bin directory is missing on `uv python uninstall` ([8725](https://github.com/astral-sh/uv/pull/8725))
- Include member groups when locking workspace ([8736](https://github.com/astral-sh/uv/pull/8736))
- Fix bug where `python_version < '0'` could appear in a final resolution ([8759](https://github.com/astral-sh/uv/pull/8759))
- Sanitize filenames during zip extraction ([8732](https://github.com/astral-sh/uv/pull/8732))
- Switch to RFC 9110 compatible format for exclude newer requests ([8752](https://github.com/astral-sh/uv/pull/8752))

Preview features

- Add support for installing versioned Python executables on Windows ([8663](https://github.com/astral-sh/uv/pull/8663))
- Improve interactions with existing Python executables during install ([8733](https://github.com/astral-sh/uv/pull/8733))

Rust API

- Extend `BaseClient` to accept extra middleware ([8807](https://github.com/astral-sh/uv/pull/8807))
- Add `From` for `FlatDistributions` struct ([8800](https://github.com/astral-sh/uv/pull/8800))

Documentation

- Fix environment variable name in providing credentials section ([8740](https://github.com/astral-sh/uv/pull/8740))
- Fix `add httpx` example with real git branch ([8756](https://github.com/astral-sh/uv/pull/8756))
- Fix indentation in `projects.md` ([8772](https://github.com/astral-sh/uv/pull/8772))
- Fix link to publish guide in `README` ([8720](https://github.com/astral-sh/uv/pull/8720))
- Generate environment variables documentation from code ([8493](https://github.com/astral-sh/uv/pull/8493))
- Improve and fix some documents ([8749](https://github.com/astral-sh/uv/pull/8749))
- Improve environment variables document ([8777](https://github.com/astral-sh/uv/pull/8777))

0.4.29

Enhancements

- Sort errors during display in `uv python install` ([8684](https://github.com/astral-sh/uv/pull/8684))
- Update resolver to use disjointness checks instead of marker equality ([8661](https://github.com/astral-sh/uv/pull/8661))
- Add `riscv64` to supported Python platform tags ([8660](https://github.com/astral-sh/uv/pull/8660))

Bug fixes

- Fix hard and soft float libc detection for managed Python distributions on ARM ([8498](https://github.com/astral-sh/uv/pull/8498))
- Handle cycles in `uv pip tree` ([8689](https://github.com/astral-sh/uv/pull/8689))
- Respect dependency group markers in `uv export` ([8659](https://github.com/astral-sh/uv/pull/8659))
- Support transitive dependencies in Git workspaces ([8665](https://github.com/astral-sh/uv/pull/8665))
- Use portable paths for subdirectories in lock URLs ([8707](https://github.com/astral-sh/uv/pull/8707))
- Update `uv init --virtual` to imply `--no-package` ([8595](https://github.com/astral-sh/uv/pull/8595))

Preview

- Install versioned Python executables into the bin directory during `uv python install` (Unix only) ([8458](https://github.com/astral-sh/uv/pull/8458))

Documentation

- Clarify relationship between specifiers and `requires-python` range ([8688](https://github.com/astral-sh/uv/pull/8688))
- Fix broken link in docs ([8552](https://github.com/astral-sh/uv/pull/8552))
- Fix outdated documentation on `Requires-Python` ([8679](https://github.com/astral-sh/uv/pull/8679))
- Add Google Artifact Registry index authentication guide ([8579](https://github.com/astral-sh/uv/pull/8579))

Page 2 of 22

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.