VAULT2077
Vault 资讯瀑布官方2026.09.18 09:01 UTC+8

astral-sh/uv 发布 0.12.16

uv 0.12.16 发布：新增 Pyodide 版本，校验下载包哈希，改进锁文件与预览功能并修复多项崩溃问题。

中文处理结果

发布说明

发布于 2026-09-17。

Python

  • 新增 Pyodide 314.0.7、0.29.5 和 0.27.8（#21741）

增强

  • 依据包索引提供的哈希校验下载的 wheel 与源码分发包（#21562）
  • 允许 build-constraint-dependencies 条目包含哈希，以校验下载的构建依赖（#21467）
  • 在 required-environments 中依据 macOS wheel 部署目标支持 Darwin platform_release 标记（#21766）
  • 在解析锁文件时拒绝不支持的 Git URL 方案，而不是在冻结导出期间 panic（#21779）

预览功能

  • 在所有依赖类型中支持 lock-without-metadata，同时为远程 URL 依赖保留 package.metadata 以支持离线校验（#21163）
  • 在 uv upgrade 中遵循已配置及命令行的索引设置，包括凭据（#21776）
  • 允许 uv check 在非 uv 管理的项目及工作区之外运行（#21777）
  • 在为 uv check 选择 Python 版本时遵循 --python 和 UV_PYTHON（#21744）

缺陷修复

  • 在显示和记录的 URL 中隐去 Azure 共享访问签名（#21755）
  • 在复用缓存分发包之前检查 pylock.toml 中的归档大小（#21609）
  • 当后端元数据报告绝对路径时，在锁文件中保持用户编写的本地依赖路径为相对路径（#20631）
  • 仅当捆绑的 uv_build 后端版本与当前版本锁定匹配时才使用它（#21742）
  • 在配置了凭据时处理格式错误的索引 URL 而不 panic（#21784）
  • 对没有主机的代理 URL 报告配置错误而不是 panic（#21781）
  • 当 URL 无法转换为路径时返回隐去凭据的错误而不是 panic（#21783）

安装 uv 0.12.16

通过 shell 脚本安装预构建二进制文件

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh | sh

通过 powershell 脚本安装预构建二进制文件

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 | iex"

下载 uv 0.12.16

原始正文

astral-sh/uv released 0.12.16

Release Notes

Released on 2026-09-17.

Python

  • Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

  • Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
  • Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
  • Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
  • Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

  • Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
  • Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
  • Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
  • Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

  • Redact Azure shared access signatures from displayed and logged URLs (#21755)
  • Check archive sizes from pylock.toml before reusing cached distributions (#21609)
  • Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
  • Use the bundled uv_build backend only when its version matches active version pins (#21742)
  • Handle malformed index URLs without panicking when credentials are configured (#21784)
  • Report a configuration error instead of panicking for proxy URLs without a host (#21781)
  • Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

Install uv 0.12.16

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 | iex"

Download uv 0.12.16

FilePlatformChecksum
uv-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
uv-x86_64-apple-darwin.tar.gzIntel macOSchecksum
uv-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
uv-i686-pc-windows-msvc.zipx86 Windowschecksum
uv-x86_64-pc-windows-msvc.zipx64 Windowschecksum
uv-aarch64-unknown-linux-gnu.tar.gzARM64 Linuxchecksum
uv-i686-unknown-linux-gnu.tar.gzx86 Linuxchecksum
uv-powerpc64le-unknown-linux-gnu.tar.gzPPC64LE Linuxchecksum
uv-riscv64gc-unknown-linux-gnu.tar.gzRISCV Linuxchecksum
uv-s390x-unknown-linux-gnu.tar.gzS390x Linuxchecksum
uv-x86_64-unknown-linux-gnu.tar.gzx64 Linuxchecksum
uv-armv7-unknown-linux-gnueabihf.tar.gzARMv7 Linuxchecksum
uv-aarch64-unknown-linux-musl.tar.gzARM64 MUSL Linuxchecksum
uv-i686-unknown-linux-musl.tar.gzx86 MUSL Linuxchecksum
uv-riscv64gc-unknown-linux-musl.tar.gzRISCV MUSL Linuxchecksum
uv-x86_64-unknown-linux-musl.tar.gzx64 MUSL Linuxchecksum
uv-arm-unknown-linux-musleabihf.tar.gzARMv6 MUSL Linux (Hardfloat)checksum
uv-armv7-unknown-linux-musleabihf.tar.gzARMv7 MUSL Linuxchecksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
查看原始发布