astral-sh/uv
An extremely fast Python package and project manager, written in Rust.
How uv is put together
uv is an extremely fast Python package and project manager implemented primarily in Rust as a large Cargo workspace of ~50+ internal crates under crates/*, distributed both as a standalone binary and as a PyPI package via maturin (with a thin Python shim in python/uv/__main__.py that execs the native binary). The architecture is layered: the uv-cli crate defines the command-line interface and dispatches to command implementations that coordinate the resolver (PubGrub-based, uv-resolver), the registry/HTTP client (uv-client on reqwest/tokio), authentication (uv-auth), caching (uv-cache), and installation (uv-installer/uv-install-wheel). Data flows from CLI arguments and config files through requirement parsing (uv-pep508/uv-pep440), resolution against package indexes over HTTPS, artifact download/extraction into a global content-addressed cache, and finally installation into virtual environments. Supporting components handle Python version downloads (uv-python), Git dependencies (uv-git), building and publishing packages (uv-build-backend, uv-publish), and vulnerability auditing against OSV (uv-audit).
Languages
Frameworks
Datastores
Infrastructure
Major components
uv-auth
Manages all registry authentication: credentials from URLs, environment variables, .netrc files, system/subprocess keyrings, cloud object-store signers (reqsign AWS/Azure/GCS), per-index auth policies, and an in-memory credentials cache.
uv-client
Async HTTP client layer over reqwest with middleware (retry, multipart) for talking to package indexes and fetching distributions.
uv-resolver
Resolves dependency graphs using the PubGrub algorithm against PEP 440/508 metadata, including universal/platform-independent resolutions.
uv-installer / uv-install-wheel
Installs resolved distributions into target virtualenvs, including fast wheel installation and Windows trampoline executables.
uv-cache / uv-cache-key / uv-extract
Implements the global deduplicating on-disk cache: cache key derivation, archive unpacking, and cache lifecycle metadata.
uv-python
Discovers, downloads, and manages managed CPython/PyPy installations using download-metadata.json for version/URL/hash data.
uv-cli / uv-dispatch
Defines the clap-based CLI surface (project, pip, tool, python, venv, publish commands) and dispatches commands to their implementations.
uv-build-backend / uv-publish / uv-audit
Builds sdists/wheels per PEP 517, uploads packages to indexes, and audits installed requirements against the OSV vulnerability database.
A quiet week centered on security hardening, tightening how hashes are generated and verified and improving authorization error handling.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quiet week centered on security hardening, tightening how hashes are generated and verified and improving authorization error handling.
Week of 2026-08-17
A high-volume week of fixes and cleanups, headlined by a Rust toolchain upgrade to 1.98 and repairs to executable trampoline generation.
Week of 2026-08-10
A busy week that shipped the ability to reference package indexes by name, plus two releases (0.12.4 and 0.12.5) and a large test-infrastructure overhaul.
Week of 2026-08-03
Three quick releases (0.12.2–0.12.3) landed alongside resolution improvements, better automation for triage and rebasing, and routine dependency updates.
Week of 2026-07-27
The busiest week, shipping release 0.12.1 plus major features like direct lockfile parsing, per-package pre-release selection, and dramatically faster hashing on ARM processors.
Over the past month, uv shipped a steady stream of user-facing improvements — including referencing indexes by name, faster hashing on ARM chips, and a new `uv check --fix` command — alongside several version releases (0.12.1 through 0.12.5). A large share of the effort went into internal quality: expanding test coverage, cleaning up test infrastructure, and building automation for issue triage, pull-request promotion, and flaky-test retries. The most recent week was quieter, focused on security hardening around the threat model, hash policies, and authorization handling.
Week by week
2026-08-24A quiet week centered on security hardening, tightening how hashes are generated and verified and improving authorization error handling.latest6 changes
Chore
Security PR promotion now requires approval
Pull requests promoting security fixes to the main project must now carry a special 'bot:promote' label before they can be merged.
Refactor
Hash generation split from verification
The rules for creating package hashes were separated from the rules for checking them, making each policy easier to manage independently.
Feature
Validated source archives tracked before saving
Downloaded source archives are now represented as validated objects before being stored, adding an extra safety checkpoint.
Docs
Threat model severity guidance clarified
Documentation explaining how to rate the severity of potential threats was made clearer and more consistent.
Fix
Better errors for bad login tokens
Requests with malformed bearer authorization headers now return clear errors instead of failing silently.
Chore
CI checkout depth reduced
Continuous integration now downloads less repository history when planning builds, speeding up the pipeline.
2026-08-17A high-volume week of fixes and cleanups, headlined by a Rust toolchain upgrade to 1.98 and repairs to executable trampoline generation.6 changes
Fix
Trampoline executables repaired
Fixed how uv generates its small launcher executables and regenerated them, with a new test ensuring they stay reproducible after toolchain changes.
Chore
Rust upgraded to 1.98
The codebase moved to Rust 1.98 with a minimum supported version of 1.96, adopting newer language patterns throughout.
Fix
Human-readable file sizes fixed
Sizes below 1024 bytes now print cleanly without decimals, and rounding at unit boundaries (like exactly 1 KB) is handled correctly.
Fix
Git commit pins resolve correctly
Locking a dependency to a full Git commit hash now guarantees you get exactly that commit during installation.
Fix
Transitive extras constraints preserved
Optional feature combinations no longer lose constraint information when dependencies reference themselves through nested extras.
Refactor
Memory allocations trimmed
A batch of unnecessary memory allocations was removed across the codebase for better performance.
2026-08-10A busy week that shipped the ability to reference package indexes by name, plus two releases (0.12.4 and 0.12.5) and a large test-infrastructure overhaul.6 changes
Feature
Indexes can be referenced by name
You can now point `--index` and `--default-index` at a named index defined in your configuration instead of repeating its URL.
Fix
Relative indexes fixed in scripts
Python scripts with inline metadata (PEP 723) now correctly handle index locations given as relative paths.
Feature
Hashes included in CycloneDX exports
Security-focused CycloneDX bill-of-materials exports now include package integrity hashes.
Fix
Scripts ending in .py no longer misread
A URL that happens to end in '.py' is no longer mistaken for a local script file path.
Fix
Cache size reporting more reliable
On filesystems that don't support detailed usage tracking, uv falls back to logical cache accounting so sizes still report sensibly.
Chore
Test infrastructure consolidated
Dozens of tests were migrated to shared 'test context' helpers, making the suite easier to maintain and extend.
2026-08-03Three quick releases (0.12.2–0.12.3) landed alongside resolution improvements, better automation for triage and rebasing, and routine dependency updates.6 changes
Feature
New output format option for cache size
`uv cache size` gained an `--output-format` flag so results can be emitted in machine-readable form.
Fix
Fork strategy respected in environments
The fork-strategy setting, which controls how the resolver splits work, is now honored when resolving multiple environments.
Fix
Comments preserved when updating dependencies
Editing a dependency version in pyproject.toml no longer wipes out inline comments on that line.
Chore
Automated issue triage drafting
Automation agents now draft maintainer responses and record issue context directly onto linked branches during triage.
Chore
Automatic rebase label support
Pull requests labeled 'bot:rebase' are automatically rebased, and failed CI jobs classified as flaky are retried automatically.
Fix
Star-operator patches accept whitespace
Version requirements using the star operator now tolerate whitespace before the version number.
2026-07-27The busiest week, shipping release 0.12.1 plus major features like direct lockfile parsing, per-package pre-release selection, and dramatically faster hashing on ARM processors.6 changes
Refactor
SHA-256 hashing accelerated on ARM
Upgrading the SHA-2 library enabled hardware-accelerated hashing on ARM chips, with MD5 and BLAKE2 upgraded to match the new digest API.
Feature
uv parses its own lockfiles directly
uv can now read uv.lock files natively rather than going through intermediate representations, simplifying internal tooling.
Feature
Per-package pre-release selection
You can now opt specific packages into pre-release versions without enabling pre-releases globally.
Feature
`uv check --fix` added
The new --fix flag lets `uv check` automatically apply corrections to problems it finds in a project.
Feature
Xonsh activation support
Virtual environments created by uv now include an activation script for the Xonsh shell.
Feature
Local HTML flat indexes supported
Flat package indexes stored as local HTML files can now be used as package sources.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 89 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required