0.12.17 0.12.18
astral-sh/uvSep 18, 2026 → Sep 22, 20264 days between releases
What's New
Adds JSON output and check modes to pip commands while patching a Windows path traversal security vulnerability.
New Features
- Add `--output-format json` and `--check` flags to `uv pip install` and `uv pip sync`.
- Preview feature to validate build requirements with `--preview-features build-dependency-check`.
Improvements
- Security fix for path traversal weakness on Windows during wheel installation.
- Performance improvement for editable wheel creation by omitting compression.
- Identify failures from build hooks correctly in build errors.
Bug Fixes
- Restore project, script, and lock files if `uv add`, `uv remove`, or `uv version` fails.
- Select package versions with wheels compatible with each Python resolution fork.
- Correctly interpret generic and stable-ABI wheel tags in version selection.
Upgrade Notes
No configuration changes are required. The new `--check` and `--output-format json` flags are available for `uv pip install` and `uv pip sync`. The Windows path traversal security vulnerability is patched automatically.
The Two Releases
0.12.17
Sep 18, 2026· 1 month ago
Focuses on stability improvements by replacing panics with clear errors, introduces preview features for library compatibility checks, and optimizes performance in build and resolution processes.
Full release notes0.12.18
Sep 22, 2026· 29 days ago
This release addresses a security vulnerability related to path traversal on Windows during wheel installation and introduces new JSON output and dry-run/check modes for pip commands. It also includes performance improvements and fixes for wheel compatibility, lockfile restoration, and path handling.
Full release notes