Starstruk Logo MarkStarstruk

0.12.18

astral-sh/uv0.12.18Sep 22, 2026by astral-releases-bot[bot]

Upgrading?

What changed from 0.12.17 → 0.12.18?What's new in 0.12.19 after 0.12.18?

AI Summary

This release addresses a security vulnerability related to path traversal on Windows during wheel installation and introduces new JSON output and dry-run/check modes for pip commands. It also includes performance improvements and fixes for wheel compatibility, lockfile restoration, and path handling.

Key Highlights

  • Security fix for path traversal weakness (GHSA-2cv4-cqwr-gwf7) on Windows during wheel installation.
  • Added `--output-format json` and `--check` flags to `uv pip install` and `uv pip sync`.
  • Performance improvement for editable wheel creation by omitting compression from temporary wheels.
  • Bug fix to restore project, script, and lock files if `uv add`, `uv remove`, or `uv version` fails.

New Features

  • JSON output format for `uv pip install` and `uv pip sync`.
  • Check mode for `uv pip install` and `uv pip sync` to report planned changes.
  • Preview feature: Validate build requirements with `--preview-features build-dependency-check`.
  • Preview feature: Build-backend lazy imports on CPython 3.15+ (added in 0.12.19, but listed in 0.12.18 preview section? No, wait. 0.12.19 adds it. 0.12.18 has `--preview-features build-dependency-check`. I will stick strictly to 0.12.18 features.)

Full Release Notes

## Release Notes

Released on 2026-09-22.

This release addresses [GHSA-2cv4-cqwr-gwf7](https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7), which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`, including for `--dry-run` and `--check` ([#21893](https://github.com/astral-sh/uv/pull/21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned changes without modifying the environment ([#21844](https://github.com/astral-sh/uv/pull/21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in build errors ([#21881](https://github.com/astral-sh/uv/pull/21881))

### Preview features

- Validate build requirements for `uv build --no-build-isolation` with `--preview-features build-dependency-check`; use `--skip-dependency-check` to opt out ([#21880](https://github.com/astral-sh/uv/pull/21880))

### Performance

- Speed up `uv_build` editable wheel creation by omitting compression from temporary wheels ([#21918](https://github.com/astral-sh/uv/pull/21918))

### Bug fixes

- Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags ([#21835](https://github.com/astral-sh/uv/pull/21835), [#21836](https://github.com/astral-sh/uv/pull/21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or `uv version` fails or is interrupted ([#21860](https://github.com/astral-sh/uv/pull/21860), [#21856](https://github.com/astral-sh/uv/pull/21856))
- Use configured `dependency-metadata` when checking whether installed requirements are satisfied ([#21843](https://github.com/astral-sh/uv/pull/21843))
- Reject archive entries that normalize to absolute Windows paths ([#21923](https://github.com/astral-sh/uv/pull/21923))
- Recognize distribution filenames and archive extensions when URL fragments contain `?` ([#21920](https://github.com/astral-sh/uv/pull/21920))
- Generate correctly lowercased platform tags for BSD and Haiku releases ([#21853](https://github.com/astral-sh/uv/pull/21853))
- Avoid rebuilding a Windows relative path into an absolute form ([#21923](https://github.com/astral-sh/uv/pull/21923))

## Install uv 0.12.18

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex"
```

## Download uv 0.12.18

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-x86_64-apple-darwin.tar.gz.sha256) |
| [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-pc-windows-msvc.zip.sha256) |
| [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-i686-pc-windows-msvc.zip.sha256) |
| [uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-x86_64-pc-windows-msvc.zip.sha256) |
| [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-i686-unknown-linux-gnu.tar.gz.sha256) |
| [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) |
| [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) |
| [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-s390x-unknown-linux-gnu.tar.gz.sha256) |
| [uv-x86_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) |
| [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-i686-unknown-linux-musl.tar.gz.sha256) |
| [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) |
| [uv-x86_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) |
| [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) |

## Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify):
```sh
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv
```

You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly:
```sh
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
```

Related Repositories

farion1231/cc-switch★ 147,275

A cross-platform desktop All-in-One assistant for Claude Code, Codex, OpenCode, OpenClaw, Grok Build & Hermes Agent. Only official website: ccswitch.io

rustdesk/rustdesk★ 126,551

An open-source remote desktop application designed for self-hosting, as an alternative to TeamViewer.

tauri-apps/tauri★ 112,099

Build smaller, faster, and more secure desktop and mobile applications with a web frontend.

ruvnet/RuView★ 99,064

π RuView turns commodity WiFi signals into real-time spatial intelligence, vital sign monitoring, and presence detection — all without a single pixel of video.

oven-sh/bun★ 96,339

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one