← All reportsPublic report

astral-sh/uv

An extremely fast Python package and project manager, written in Rust.

89k stars Rust View on GitHubprofiled 11d ago
Try GitZoid
400PRs this week
32Contributors
89Deps scanned
0Issues found
01 · Repo overview

How uv is put together

uv is an extremely fast Python package and project manager implemented primarily in Rust as a large Cargo workspace of ~50+ internal crates under crates/*, distributed both as a standalone binary and as a PyPI package via maturin (with a thin Python shim in python/uv/__main__.py that execs the native binary). The architecture is layered: the uv-cli crate defines the command-line interface and dispatches to command implementations that coordinate the resolver (PubGrub-based, uv-resolver), the registry/HTTP client (uv-client on reqwest/tokio), authentication (uv-auth), caching (uv-cache), and installation (uv-installer/uv-install-wheel). Data flows from CLI arguments and config files through requirement parsing (uv-pep508/uv-pep440), resolution against package indexes over HTTPS, artifact download/extraction into a global content-addressed cache, and finally installation into virtual environments. Supporting components handle Python version downloads (uv-python), Git dependencies (uv-git), building and publishing packages (uv-build-backend, uv-publish), and vulnerability auditing against OSV (uv-audit).

Languages

RustPython

Frameworks

tokio (async runtime)clap (CLI framework)reqwest (HTTP client)astral-pubgrub (dependency resolution)maturin (PyPI/Rust hybrid packaging)

Datastores

on-disk global package cache (content-addressed)OS keyring (credential store via uv-keyring)

Infrastructure

Dockerfilecargo-dist release pipeline (dist-workspace.toml)PyPI distribution (pip installable binary)standalone installer scripts (curl | sh / PowerShell)mkdocs documentation site

Major components

uv-auth

Manages all registry authentication: credentials from URLs, environment variables, .netrc files, system/subprocess keyrings, cloud object-store signers (reqsign AWS/Azure/GCS), per-index auth policies, and an in-memory credentials cache.

uv-client

Async HTTP client layer over reqwest with middleware (retry, multipart) for talking to package indexes and fetching distributions.

uv-resolver

Resolves dependency graphs using the PubGrub algorithm against PEP 440/508 metadata, including universal/platform-independent resolutions.

uv-installer / uv-install-wheel

Installs resolved distributions into target virtualenvs, including fast wheel installation and Windows trampoline executables.

uv-cache / uv-cache-key / uv-extract

Implements the global deduplicating on-disk cache: cache key derivation, archive unpacking, and cache lifecycle metadata.

uv-python

Discovers, downloads, and manages managed CPython/PyPy installations using download-metadata.json for version/URL/hash data.

uv-cli / uv-dispatch

Defines the clap-based CLI surface (project, pip, tool, python, venv, publish commands) and dispatches commands to their implementations.

uv-build-backend / uv-publish / uv-audit

Builds sdists/wheels per PEP 517, uploads packages to indexes, and audits installed requirements against the OSV vulnerability database.

Over the past month, uv shipped a steady stream of user-facing improvements — including referencing indexes by name, faster hashing on ARM chips, and a new `uv check --fix` command — alongside several version releases (0.12.1 through 0.12.5). A large share of the effort went into internal quality: expanding test coverage, cleaning up test infrastructure, and building automation for issue triage, pull-request promotion, and flaky-test retries. The most recent week was quieter, focused on security hardening around the threat model, hash policies, and authorization handling.

Week by week

2026-08-24A quiet week centered on security hardening, tightening how hashes are generated and verified and improving authorization error handling.latest6 changes

Chore

Security PR promotion now requires approval

Pull requests promoting security fixes to the main project must now carry a special 'bot:promote' label before they can be merged.

Refactor

Hash generation split from verification

The rules for creating package hashes were separated from the rules for checking them, making each policy easier to manage independently.

Feature

Validated source archives tracked before saving

Downloaded source archives are now represented as validated objects before being stored, adding an extra safety checkpoint.

Docs

Threat model severity guidance clarified

Documentation explaining how to rate the severity of potential threats was made clearer and more consistent.

Fix

Better errors for bad login tokens

Requests with malformed bearer authorization headers now return clear errors instead of failing silently.

Chore

CI checkout depth reduced

Continuous integration now downloads less repository history when planning builds, speeding up the pipeline.

2026-08-17A high-volume week of fixes and cleanups, headlined by a Rust toolchain upgrade to 1.98 and repairs to executable trampoline generation.6 changes

Fix

Trampoline executables repaired

Fixed how uv generates its small launcher executables and regenerated them, with a new test ensuring they stay reproducible after toolchain changes.

Chore

Rust upgraded to 1.98

The codebase moved to Rust 1.98 with a minimum supported version of 1.96, adopting newer language patterns throughout.

Fix

Human-readable file sizes fixed

Sizes below 1024 bytes now print cleanly without decimals, and rounding at unit boundaries (like exactly 1 KB) is handled correctly.

Fix

Git commit pins resolve correctly

Locking a dependency to a full Git commit hash now guarantees you get exactly that commit during installation.

Fix

Transitive extras constraints preserved

Optional feature combinations no longer lose constraint information when dependencies reference themselves through nested extras.

Refactor

Memory allocations trimmed

A batch of unnecessary memory allocations was removed across the codebase for better performance.

2026-08-10A busy week that shipped the ability to reference package indexes by name, plus two releases (0.12.4 and 0.12.5) and a large test-infrastructure overhaul.6 changes

Feature

Indexes can be referenced by name

You can now point `--index` and `--default-index` at a named index defined in your configuration instead of repeating its URL.

Fix

Relative indexes fixed in scripts

Python scripts with inline metadata (PEP 723) now correctly handle index locations given as relative paths.

Feature

Hashes included in CycloneDX exports

Security-focused CycloneDX bill-of-materials exports now include package integrity hashes.

Fix

Scripts ending in .py no longer misread

A URL that happens to end in '.py' is no longer mistaken for a local script file path.

Fix

Cache size reporting more reliable

On filesystems that don't support detailed usage tracking, uv falls back to logical cache accounting so sizes still report sensibly.

Chore

Test infrastructure consolidated

Dozens of tests were migrated to shared 'test context' helpers, making the suite easier to maintain and extend.

2026-08-03Three quick releases (0.12.2–0.12.3) landed alongside resolution improvements, better automation for triage and rebasing, and routine dependency updates.6 changes

Feature

New output format option for cache size

`uv cache size` gained an `--output-format` flag so results can be emitted in machine-readable form.

Fix

Fork strategy respected in environments

The fork-strategy setting, which controls how the resolver splits work, is now honored when resolving multiple environments.

Fix

Comments preserved when updating dependencies

Editing a dependency version in pyproject.toml no longer wipes out inline comments on that line.

Chore

Automated issue triage drafting

Automation agents now draft maintainer responses and record issue context directly onto linked branches during triage.

Chore

Automatic rebase label support

Pull requests labeled 'bot:rebase' are automatically rebased, and failed CI jobs classified as flaky are retried automatically.

Fix

Star-operator patches accept whitespace

Version requirements using the star operator now tolerate whitespace before the version number.

2026-07-27The busiest week, shipping release 0.12.1 plus major features like direct lockfile parsing, per-package pre-release selection, and dramatically faster hashing on ARM processors.6 changes

Refactor

SHA-256 hashing accelerated on ARM

Upgrading the SHA-2 library enabled hardware-accelerated hashing on ARM chips, with MD5 and BLAKE2 upgraded to match the new digest API.

Feature

uv parses its own lockfiles directly

uv can now read uv.lock files natively rather than going through intermediate representations, simplifying internal tooling.

Feature

Per-package pre-release selection

You can now opt specific packages into pre-release versions without enabling pre-releases globally.

Feature

`uv check --fix` added

The new --fix flag lets `uv check` automatically apply corrections to problems it finds in a project.

Feature

Xonsh activation support

Virtual environments created by uv now include an activation script for the Xonsh shell.

Feature

Local HTML flat indexes supported

Flat package indexes stored as local HTML files can now be used as package sources.

03 · Security check

Dependencies and code review

89 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 89 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required