0.13.3 0.13.4
medium risk
astral-sh/uvOct 20, 2026 → Oct 20, 20261 day between releases
What's New
Updates bundled Mozilla root certificates to fix a security vulnerability and validates PEP 825 variant metadata.
New Features
- Validates PEP 825 variant metadata and treats invalid versions as unavailable under wheel-variants
Improvements
- Updates bundled Mozilla root certificates via webpki-root-certs 1.0.10 to address a compromised CA
Upgrade Notes
Upgrade immediately to address the compromised root CA and verify other software using bundled CAs. Note that packages with invalid PEP 825 metadata may become unavailable under wheel-variants.
The Two Releases
0.13.3
0.13.3
Oct 20, 2026· 2 days ago
This release focuses on performance optimization, specifically addressing severe slowdowns in the `uv export` command when handling dependency graphs containing extras.
Full release notes