changelogs/0.11.x.md
Released on 2026-03-23.
This release includes changes to the networking stack used by uv. While we think that breakage will be rare, it is possible that these changes will result in the rejection of certificates previously trusted by uv so we have marked the change as breaking out of an abundance of caution.
The changes are largely driven by the upgrade of reqwest, which powers uv's HTTP clients, to v0.13 which included some breaking changes to TLS certificate verification.
The following changes are included:
rustls-platform-verifier is used instead
of rustls-native-certs and
webpki for certificate verification
This change should have no effect unless you are using the native-tls option to enable reading
system certificates.
rustls-platform-verifier delegates to the system for certificate validation (e.g.,
Security.framework on macOS) instead of eagerly loading certificates from the system and
verifying them via webpki. The effects of this change will vary based on the operating system.
In general, uv's certificate validation should now be more consistent with browsers and other
native applications. However, this is the most likely cause of breaking changes in this release.
Some previously failing certificate chains may succeed, and some previously accepted certificate
chains may fail. In either case, we expect the validation to be more correct and welcome reports
of regressions.
In particular, because more responsibility for validating the certificate is transferred to your system's security library, some features like CA constraints or revocation of certificates via OCSP and CRLs may now be used.
This change should improve performance when using system certificate on macOS, as uv no longer needs to load all certificates from the keychain at startup.
aws-lc is used instead of ring for a cryptography backend
There should not be breaking changes from this change. We expect this to expand support for certificate signature algorithms.
--native-tls is deprecated in favor of a new --system-certs flag
The --native-tls flag is still usable and has identical behavior to --system-certs.
This change was made to reduce confusion about the TLS implementation uv uses. uv always uses
rustls not native-tls.
Building uv on x86-64 and i686 Windows requires NASM
NASM is required by aws-lc. If not found on the system, a prebuilt blob provided by aws-lc-sys
will be used.
If you are not building uv from source, this change has no effect.
See the CONTRIBUTING guide for details.
Empty SSL_CERT_FILE values are ignored (for consistency with SSL_CERT_DIR)
See #18550 for details.
See the python-build-standalone release notes for details.
--service-format and --service-url to uv audit
(#18571)uv tool list --outdated
(#18586)uv export for workspace member packages with conflicts
(#18635)FLASH_ATTENTION_SKIP_CUDA_BUILD guidance for flash-attn installs
(#18473)Released on 2026-03-24.
riscv64gc-unknown-linux-musl
(#18686)== Python version request ranges
(#9697)--python <dir> in "Using arbitrary Python environments"
(#6457)PS_MODULE_PATH and UV_WORKING_DIR
(#18691)Released on 2026-03-26.
uv self update fetch the manifest from the mirror first
(#18679)uv self update success and failure messages with --quiet
(#18645)uv run
(#17890)Released on 2026-04-01.
uv workspace metadata with dependency information from the lock
(#18356)/installers/uv/latest on the mirror
(#18725)--ignore and --ignore-until-fixed to uv audit
(#18737)blake2b hashes (#18794)powerpc64-unknown-linux-gnu from release build targets
(#18800)uv pip check
(#18742)Released on 2026-04-07.
--upgrade-group (#18266)pyproject.toml dependencies
(#18786)--locked and --frozen when script lockfile is missing
(#18832)uv export extra resolution for workspace member and conflicting extras
(#18888)exclude-newer values during uv tree --outdated
(#18899)--exclude-newer in uv tool list --outdated
(#18861)Cargo.lock in uv-build source distributions
(#18831)--exclude-newer compares artifact upload times
(#18830)Released on 2026-04-08.
build_system.requires error message (#18911)exclude-newer to [[tool.uv.index]] (#18839)uv audit: add context/warnings for ignored vulnerabilities
(#18905)PIP_COMPATIBILITY.md redirect file
(#18928)uv init example-bare --bare examples (#18822,
#18925)Released on 2026-04-09.
This release resolves a low severity security advisory in which wheels with malformed RECORD entries could delete arbitrary files on uninstall. See GHSA-pjjw-68hj-v9mw for details.
RECORD during installation
(#18943)uv cache clean errors due to Win32 path normalization
(#18856)Released on 2026-04-15.
required-version mismatches
(#18977)--exclude-newer hints (#18952)workspace metadata in linehaul data
(#18966)uv sync --check failures
(#18976)~= operators
(#18960)Released on 2026-04-27.
--python-downloads-json-url to python pin
(#19092)pip uninstall -y (#19082)exclude-newer to be missing from the lockfile when exclude-newer-span is present
(#19024)uv self version --short
(#19019)SSL_CERT_DIR directory
(#19018)exclude-newer and exclude-newer-package values in
lockfiles (#19022,
#19101)UV_PYTHON_NO_REGISTRY (#19035)UV_NO_PROJECT
(#19052)UV_PYTHON_SEARCH_PATH for Python discovery PATH overrides
(#19034)rust-toolchain.toml to uv-build sdist (#19131)uv lock on a pyproject.toml that only contains dependency-groups
(#19087).python-version (#19102).tar.zst wheels (#19144)Released on 2026-05-04.
This release includes a special release candidate for the next Python 3.14 patch release. Python 3.14 included a new garbage collection implementation, which reduced pause times but caused significant unexpected memory pressure in production environments. In 3.14.5 and 3.15, the previous garbage collection implementation will be restored.
We would greatly appreciate if you tested the 3.14.5rc1 version included in this release. The stable version is expected to be released soon and any feedback on potential issues would be helpful to the Python development team.
For more context, see the announcement, issue, and pull request.
Issues with the new release can be reported in the uv or CPython issue trackers.
libpython to match Linuxuv audit add reporting for adverse project statuses
(#19128)requires-python pins a version
(#18700)LockedFile::drop on Wine
(#19229)top_level.txt in .egg-info
(#19114)PYTHONHOME and only set __PYVENV_LAUNCHER__ for virtual
environments (#19199)--native-tls and UV_NATIVE_TLS as deprecated
(#18705)pytorch-triton-rocm to PyTorch ROCm docs
(#19241)uv init creates git files / folders in the projects guide
(#19183)Released on 2026-05-05.
Released on 2026-05-06.
Released on 2026-05-08.
--no-editable support to uv pip install
(#19306)--no-dev over UV_DEV=1 (#19313)--no-frozen flag (#19290)
(#19294)Released on 2026-05-10.
--require-hashes when installing from pylock.toml files
(#19334)Released on 2026-05-12.
top_level.txt entries in uninstall that are not valid Python identifiers
(#19340).env files in parent process
(#19343)uv tree showing extra-conditional deps for packages required without extras
(#19332)--no-build) during lock validation
(#19366)Released on 2026-05-18.
required-environments in uv pip compile
(#19378)Version::only_release_trimmed
(#19425)[tool.uv.sources] credentials under uv sync --frozen
(#19423)Released on 2026-05-21.
UV_NO_SYSTEM_CONFIG
(#19476)uv-build (#19495)Released on 2026-05-28.
uv add with standard library modules
(#19572)uv workspace and its list subcommand in help output
(#19533)ignore-error-codes when applicable
(#19521)import-names and import-namespaces support to uv-build
(PEP 794)
(#19380)--no-editable-package flag to various commands
(#19584)uv tool invocations
(#19577)uv workspace metadata
(#19122)uv venv --clear to remove non-virtual environments
(#19595)tool.uv.conflicts
(#19538)--env-file in uv run
(#19567)--check-url (#19594)--find-links parsing
(#19537)Released on 2026-06-01.
uv check to run ty from uv (#19605)Released on 2026-06-03.
--isolated in uv check (#19666)Released on 2026-06-10.
--emit-index-url and --emit-find-links to uv export
(#18370)--find-links support for uv pip list
(#16103)uv python install
(#19691)UV_NO_INSTALL_PROJECT, UV_NO_INSTALL_WORKSPACE, UV_NO_INSTALL_LOCAL
(#19323)VIRTUAL_ENV through cygpath inside fish on Windows
(#19703)Released on 2026-06-11.
environment.root to uv workspace metadata --sync
(#19760)uv upgrade to update a single dependency constraint
(#19738)uv workspace metadata payload in ty check
(#19763)uv init
(#17841)uv python list
(#18684)Released on 2026-06-18.
uv publish
(#19831)TY and RUFF env vars for providing paths for binaries used by uv format and uv check
(#19821)uv.toml and pyproject.toml
(#18437)uv check --no-sync
(#19909)--script to uv check and uv metadata
(#19860)workspace metadata
(#19862)uv audit output (#19872)include-group entries that have additional fields
(#19866)backend-paths exist when building sdists
(#19834)pylock.toml files do not have an unsupported a lock-version
(#19869)packages.requires-python of a pylock.toml
(#19868)uv to be recursively invoked by PEP 517 build hooks
(#19879)credentials.toml files (#19815)uv pip list
(#19867)uv tree --invert
(#19910)uv venv in a project
(#19837)uv tree
(#19905)Released on 2026-06-19.
pre-commit-uv (#19925)pyproject.toml would be
treated as standalone projects (#19926)Released on 2026-06-23.
exclude-newer (#19934)activate.fish and broaden Fish version support
(#19856)Released on 2026-06-26.
This release updates our tar library, astral-tokio-tar, to v0.6.3, which includes over 20 changes that harden our tar handling against parser differentials. uv may reject source distributions with malformed or ambiguous content that were previously accepted.
See the upstream commits for a full list of changes.
tool.uv.environments
(#19933)uv workspace list --scripts (#20009)uv venv
(#19912)uv check (#19884)uv check
(#19995)uv check --script
(#19989)uv build if the cache dir is enclosed
(#19991)Released on 2026-06-30.
ForkMap::contains (#20023)Released on 2026-07-06.
--python-downloads-json-url
(#16749)uv workspace list --scripts
(#20099)requires-python specifiers in Simple API parsing
(#20104)packages table for pylock.toml
(#20145)uv pip tree (#20062)uv add --index updates an existing index URL
(#19818)Released on 2026-07-07.
This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.
See the upstream commits for a full list of changes.
-q and -qq
(#20163)uv build errors
(#20159)uv pip install
(#19914)--upgrade when upgrade-package is configured
(#19955)uv tree in dependency-group-only projects
(#20167)Released on 2026-07-15.
uv tree (#19978)pylock.toml
(#20393)uv audit --service-url values instead of panicking
(#20374)uv sync operations
(#20364)uv tree, uv export, uv format, and uv audit
(#20359)pylock.toml
(#20391)uv pip freeze output
(#20395)uv pip install --strict has nothing to
install (#20388)platlib when purelib is missing
(#20405).egg-info files as legacy package metadata
(#20403)pylock.toml artifact URLs instead of panicking
(#20373)--no-build behavior for editable requirements
(#20234)Released on 2026-07-20.
uv workspace metadata --sync to target the active virtual environment with --active
(#20500)exclude-newer
(#20460)toml_writer
(#20450)extends-environment paths in pyvenv.cfg on Unix
(#20466)Released on 2026-07-21.
.venv files containing paths to centralized project environments
(#20022)hash-algorithm setting for lockfile generation
(#20605)audit.malware-check and audit.malware-check-url settings
(#20587)--emit-build-options for unsupported uv pip compile --emit-options
(#20582)uv_build settings for in-tree build backends
(#20153)Released on 2026-07-23.
--package and --all-packages selection to uv check
(#20628)uv upgrade to update multiple marker-specific declarations of the same package
(#20335)uv lock --check and commands using --locked
(#20646)uv lock --refresh
(#20634)uv workspace metadata by default
(#20643)Requires-Python is discovered only from distribution metadata
(#20586)Released on 2026-07-28.
.tar.gz archives for Pyodide installs (#20667)uv check unless --script is passed
(#20676)package.metadata-free lockfiles
(#20688,
#20691,
#20685,
#20695)