catppuccin
chore(deps): update dependency astral-sh/uv to v0.9.11
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| astral-sh/uv | uses-with | minor | 0.6.3 -> 0.9.11 |
Release Notes
astral-sh/uv (astral-sh/uv)
v0.9.11
Released on 2025-11-20.
Python
- Add CPython 3.15.0a2
See the python-build-standalone release notes for details.
Enhancements
Preview features
Bug fixes
- Fix
uv initauthor serialization viatoml_editinline tables (#16778) - Fix status messages without TTY (#16785)
- Preserve end-of-line comment whitespace when editing
pyproject.toml(#16734) - Disable
always-authenticatewhen running under Dependabot (#16773)
Documentation
- Document the new behavior for free-threaded python versions (#16781)
- Improve note about build system in publish guide (#16788)
- Move do not upload publish note out of the guide into concepts (#16789)
v0.9.10
Released on 2025-11-17.
Enhancements
- Add support for
SSL_CERT_DIR(#16473) - Enforce UTF‑8-encoded license files during
uv build(#16699) - Error when a
project.license-filesglob matches nothing (#16697) -
pip install --target(andsync) install Python if necessary (#16694) - Account for
python_downloads_json_urlin pre-release Python version warnings (#16737) - Support HTTP/HTTPS URLs in
uv python --python-downloads-json-url(#16542)
Preview features
- Add support for
--upgradeinuv python install(#16676) - Fix handling of
python install --defaultfor pre-release Python versions (#16706) - Add
uv workspace listto list workspace members (#16691)
Bug fixes
- Don't check file URLs for ambiguously parsed credentials (#16759)
Documentation
- Add a "storage" reference document (#15954)
v0.9.9
Released on 2025-11-12.
Deprecations
- Deprecate use of
--projectinuv init(#16674)
Enhancements
- Add iOS support to Python interpreter discovery (#16686)
- Reject ambiguously parsed URLs (#16622)
- Allow explicit values in
uv version --bump(#16555) - Warn on use of managed pre-release Python versions when a stable version is available (#16619)
- Allow signing trampolines on Windows by using
.rcdatato store metadata (#15068) - Add
--only-emit-workspaceand similar variants touv export(#16681)
Preview features
Configuration
- Add
UV_NO_DEFAULT_GROUPSenvironment variable (#16645)
Bug fixes
- Remove
torch-model-archiverandtorch-tb-profilerfrom PyTorch backend (#16655) - Fix Pixi environment detection (#16585)
Documentation
- Fix
CMDpath in FastAPI Dockerfile (#16701)
v0.9.8
Released on 2025-11-07.
Enhancements
- Accept multiple packages in
uv export(#16603) - Accept multiple packages in
uv sync(#16543) - Add a
uv cache sizecommand (#16032) - Add prerelease guidance for build-system resolution failures (#16550)
- Allow Python requests to include
+gilto require a GIL-enabled interpreter (#16537) - Avoid pluralizing 'retry' for single value (#16535)
- Enable first-class dependency exclusions (#16528)
- Fix inclusive constraints on available package versions in resolver errors (#16629)
- Improve
uv initerror for invalid directory names (#16554) - Show help on
uv build -h(#16632) - Include the Python variant suffix in "Using Python ..." messages (#16536)
- Log most recently modified file for cache-keys (#16338)
- Update Docker builds to use nightly Rust toolchain with musl v1.2.5 (#16584)
Configuration
- Expose
UV_NO_GROUPas an environment variable (#16529) - Add
UV_NO_SOURCESas an environment variable (#15883)
Bug fixes
- Allow
--checkand--lockedto be used together inuv lock(#16538) - Allow for unnormalized names in the METADATA file (#16547) (#16548)
- Fix missing value_type for
default-groupsin schema (#16575) - Respect multi-GPU outputs in
nvidia-smi(#15460) - Fix DNS lookup errors in Docker containers (#8450)
Documentation
Other changes
- Update Rust toolchain to 1.91 and MSRV to 1.89 (#16531)
v0.9.7
Released on 2025-10-30.
Enhancements
- Add Windows x86-32 emulation support to interpreter architecture checks (#13475)
- Improve readability of progress bars (#16509)
- Add GitHub attestations for uv release artifacts (#11357)
Bug fixes
- Drop terminal coloring from
uv auth tokenoutput (#16504) - Don't use UV_LOCKED to enable
--checkflag (#16521)
v0.9.6
Released on 2025-10-29.
This release contains an upgrade to Astral's fork of async_zip, which addresses potential sources of ZIP parsing differentials between uv and other Python packaging tooling. See GHSA-pqhf-p39g-3x64 for additional details.
Security
- Address ZIP parsing differentials (GHSA-pqhf-p39g-3x64)
Python
- Upgrade GraalPy to 25.0.1 (#16401)
Enhancements
- Add
--cleartouv buildto remove old build artifacts (#16371) - Add
--no-create-gitignoretouv build(#16369) - Do not error when a virtual environment directory cannot be removed due to a busy error (#16394)
- Improve hint on
pip install --systemwhen externally managed (#16392) - Running
uv lock --checkwith outdated lockfile will print that--checkwas passed, instead of--locked(#16322) - Update
uv inittemplate for Maturin (#16449) - Improve ordering of Python sources in logs (#16463)
- Restore DockerHub release images and annotations (#16441)
Bug fixes
- Check for matching Python implementation during
uv python upgrade(#16420) - Deterministically order
--find-linksdistributions (#16446) - Don't panic in
uv export --frozenwhen the lockfile is outdated (#16407) - Fix root of
uv treewhen--packageis used with circular dependencies (#15908) - Show package list with
pip freeze --quiet(#16491) - Limit
uv auth login pyx.devretries to 60s (#16498) - Add an empty group with
uv add --group ... -r ...(#16490)
Documentation
- Update docs for maturin build backend init template (#16469)
- Update docs to reflect previous changes to signal forwarding semantics (#16430)
- Add instructions for installing via MacPorts (#16039)
v0.9.5
Released on 2025-10-21.
This release contains an upgrade to astral-tokio-tar, which addresses a vulnerability in tar extraction on malformed archives with mismatching size information between the ustar header and PAX extensions. While the astral-tokio-tar advisory has been graded as "high" due its potential broader impact, the specific impact to uv is low due to a lack of novel attacker capability. Specifically, uv only processes tar archives from source distributions, which already possess the capability for full arbitrary code execution by design, meaning that an attacker gains no additional capabilities through astral-tokio-tar.
Regardless, we take the hypothetical risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this upgrade an advisory: https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
Security
- Upgrade
astral-tokio-tarto 0.5.6 to address a parsing differential (#16387)
Enhancements
- Add required environment marker example to hint (#16244)
- Fix typo in MissingTopLevel warning (#16351)
- Improve 403 Forbidden error message to indicate package may not exist (#16353)
- Add a hint on
uv pip installfailure if the--systemflag is used to select an externally managed interpreter (#16318)
Bug fixes
- Fix backtick escaping for PowerShell (#16307)
Documentation
v0.9.4
Released on 2025-10-17.
Enhancements
- Add CUDA 13.0 support (#16321)
- Add auto-detection for Intel GPU on Windows (#16280)
- Implement display of RFC 9457 HTTP error contexts (#16199)
Bug fixes
- Avoid obfuscating pyx tokens in
uv auth tokenoutput (#16345)
v0.9.3
Released on 2025-10-14.
Python
- Add CPython 3.15.0a1
- Add CPython 3.13.9
Enhancements
- Obfuscate secret token values in logs (#16164)
Bug fixes
- Fix workspace with relative pathing (#16296)
v0.9.2
Released on 2025-10-10.
Python
- Add CPython 3.9.24.
- Add CPython 3.10.19.
- Add CPython 3.11.14.
- Add CPython 3.12.12.
Enhancements
Documentation
- Add missing "added in" to new environment variables in reference (#16217)
v0.9.1
Released on 2025-10-09.
Enhancements
Configuration
- Add
UV_UPLOAD_HTTP_TIMEOUTand respectUV_HTTP_TIMEOUTin uploads (#16040) - Support
UV_WORKING_DIRECTORYfor setting--directory(#16125)
Bug fixes
- Allow missing
Scriptsdirectory (#16206) - Fix handling of Python requests with pre-releases in ranges (#16208)
- Preserve comments on version bump (#16141)
- Retry all HTTP/2 errors (#16038)
- Treat deleted Windows registry keys as equivalent to missing ones (#16194)
- Ignore pre-release Python versions when a patch version is requested (#16210)
Documentation
- Document why uv discards upper bounds on
requires-python(#15927) - Document uv version environment variables were added in (#15196)
v0.9.0
Released on 2025-10-07.
This breaking release is primarily motivated by the release of Python 3.14, which contains some breaking changes (we recommend reading the "What's new in Python 3.14" page). uv may use Python 3.14 in cases where it previously used 3.13, e.g., if you have not pinned your Python version and do not have any Python versions installed on your machine. While we think this is uncommon, we prefer to be cautious. We've included some additional small changes that could break workflows.
See our Python 3.14 blog post for some discussion of features we're excited about!
There are no breaking changes to uv_build. If you have an upper bound in your [build-system] table, you should update it.
Breaking changes
-
Python 3.14 is now the default stable version
The default Python version has changed from 3.13 to 3.14. This applies to Python version installation when no Python version is requested, e.g.,
uv python install. By default, uv will use the system Python version if present, so this may not cause changes to general use of uv. For example, if Python 3.13 is installed already, thenuv venvwill use that version. If no Python versions are installed on a machine and automatic downloads are enabled, uv will now use 3.14 instead of 3.13, e.g., foruv venvoruvx python. This change will not affect users who are using a.python-versionfile to pin to a specific Python version. -
Allow use of free-threaded variants in Python 3.14+ without explicit opt-in (#16142)
Previously, free-threaded variants of Python were considered experimental and required explicit opt-in (i.e., with
3.14t) for usage. Now uv will allow use of free-threaded Python 3.14+ interpreters without explicit selection. The GIL-enabled build of Python will still be preferred, e.g., when performing an installation withuv python install 3.14. However, e.g., if a free-threaded interpreter comes before a GIL-enabled build on thePATH, it will be used. This change does not apply to free-threaded Python 3.13 interpreters, which will continue to require opt-in. -
Use Python 3.14 stable Docker images (#16150)
Previously, the Python 3.14 images had an
-rcsuffix, e.g.,python:3.14-rc-alpineorpython:3.14-rc-trixie. Now, the-rcsuffix has been removed to match the stable upstream images. The-rcimages tags will no longer be updated. This change should not break existing workflows. -
Upgrade Alpine Docker image to Alpine 3.22
Previously, the
uv:alpineDocker image was based on Alpine 3.21. Now, this image is based on Alpine 3.22. The previous image can be recovered withuv:alpine3.21and will continue to be updated until a future release. -
Upgrade Debian Docker images to Debian 13 "Trixie"
Previously, the
uv:debiananduv:debian-slimDocker images were based on Debian 12 "Bookworm". Now, these images are based on Debian 13 "Trixie". The previous images can be recovered withuv:bookwormanduv:bookworm-slimand will continue to be updated until a future release. -
Fix incorrect output path when a trailing
/is used inuv build(#15133)When using
uv buildin a workspace, the artifacts are intended to be written to adistdirectory in the workspace root. A bug caused workspace root determination to fail when the input path included a trailing/causing thedistdirectory to be placed in the child directory. This bug has been fixed in this release. For example,uv build child/is used, the output path will now be in<workspace root>/dist/rather than<workspace root>/child/dist/.
Python
- Add CPython 3.14.0
- Add CPython 3.13.8
Enhancements
- Don't warn when a dependency is constrained by another dependency (#16149)
Bug fixes
- Fix
uv python upgrade / installoutput when there is a no-op for one request (#16158) - Surface pinned-version hint when
uv tool upgradecan’t move the tool (#16081) - Ban pre-release versions in
uv python upgraderequests (#16160) - Fix
uv python upgradereplacement of installed binaries on pre-release to stable (#16159)
Documentation
- Update
uv pip compileargs inlayout.md(#16155)
v0.8.24
Release Notes
Released on 2025-10-06.
Enhancements
- Emit a message on
cache cleanandprunewhen lock is held (#16138) - Add
--forceflag foruv cache prune(#16137)
Documentation
- Fix example of bumping beta version without patch bump (#16132)
Install uv 0.8.24
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.24/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.24/uv-installer.ps1 | iex"
Download uv 0.8.24
v0.8.23
Release Notes
Released on 2025-10-03.
Enhancements
- Build
s390xon stable Rust compiler version (#16082) - Add
UV_SKIP_WHEEL_FILENAME_CHECKto allow installing invalid wheels (#16046)
Bug fixes
- Avoid rejecting already-installed URL distributions with
--no-sources(#16094) - Confirm that the directory name is a valid Python install key during managed check (#16080)
- Ignore origin when comparing installed tools (#16055)
- Make cache control lookups robust to username (#16088)
- Re-order lock validation checks by severity (#16045)
- Remove tracking of inferred dependency conflicts (#15909)
- Respect
--no-coloron the CLI (#16044) - Deduplicate marker-specific dependencies in
uv pip treeoutput (#16078)
Documentation
- Document transparent x86_64 emulation on aarch64 (#16041)
- Document why we ban URLs from index dependencies (#15929)
- Fix rendering of
_CONDA_ROOTin reference (#16114) - Windows arm64 and Linux RISC-V64 are Tier 2 supported (#16027)
Install uv 0.8.23
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.23/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.23/uv-installer.ps1 | iex"
Download uv 0.8.23
v0.8.22
Release Notes
Released on 2025-09-23.
Python
- Upgrade Pyodide to 0.28.3 (#15999)
Security
- Upgrade
astral-tokio-tarto 0.5.5 which hardens tar archive extraction (#16004)
Install uv 0.8.22
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.22/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.22/uv-installer.ps1 | iex"
Download uv 0.8.22
v0.8.21
Release Notes
+Released on 2025-09-23.
Enhancements
- Refresh lockfile when
--refreshis provided (#15994)
Preview features
Add support for S3 request signing (#15925)
Install uv 0.8.21
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.21/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.21/uv-installer.ps1 | iex"
Download uv 0.8.21
v0.8.20
Release Notes
Released on 2025-09-22.
Enhancements
- Add
--forceflag foruv cache clean(#15992) - Improve resolution errors with proxied packages (#15200)
Preview features
- Allow upgrading pre-release versions of the same minor Python version (#15959)
Bug fixes
- Hide
freethreaded+debugPython downloads inuv python list(#15985) - Retain the cache lock and temporary caches during
uv runanduvx(#15990)
Documentation
- Add
packagelevel conflicts to the conflicting dependencies docs (#15963) - Document pyodide support (#15962)
- Document support for free-threaded and debug Python versions (#15961)
- Expand the contribution docs on issue selection (#15966)
- Tweak title for viewing version in project guide (#15964)
Install uv 0.8.20
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.20/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.20/uv-installer.ps1 | iex"
Download uv 0.8.20
| File | Platform | Checksum |
|---|---|---|
| uv-aarch64-apple-darwin.tar.gz | Apple Silicon macOS | checksum |
| uv-x86_64-apple-darwin.tar.gz | Intel macOS | checksum |
| uv-aarch64-pc-windows-msvc.zip | ARM64 Windows | checksum |
| uv-i686-pc-windows-msvc.zip | x86 Windows | [checksum](https:/ |
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "Published by a pub.dev verified publisher"){kind=small}