Astral 于 2026 年 7 月 28 日发布了 Python 包管理工具 uv 的 0.12.0 版本[1]。此版本包含多项破坏性变更，但大多数用户无需修改即可升级[1]。
在构建系统方面，uv init 现在默认定义 build system 并使用 uv_build[1]。安全性方面的改进包括：拒绝 legacy 格式源代码分发文件（.tar.bz2、.tar.xz），仅支持 .tar.gz[1]；wheels 不再支持 bzip2、LZMA、XZ 压缩方法[1]；拒绝可能覆盖 Python 解释器的 wheel entry points[1]；在哈希检查模式下拒绝仅含 MD5 哈希值的文件[1]。
依赖解析逻辑也进行了调整，默认 pre-release 模式改为 if-necessary，优先使用稳定版本而非预发布版本[1]。此外，--require-hashes 参数现在强制启用哈希检查[1]，pylock.toml 必须包含 packages 数组[1]，SSL_CERT_FILE 或 SSL_CERT_DIR 覆盖必须有效[1]，新增支持 pip 兼容的 --cert 参数[1]。在项目操作方面，清空非虚拟环境目录需要 --force 参数[1]，初始化项目时不再允许使用 --project 参数[1]。
Astral has released version 0.12.0 of uv, its Python package management tool, on July 28, 2026 [1]. The update introduces several breaking changes designed to enhance security and improve dependency resolution behavior, though most users can upgrade without modification [1].
The new version makes significant shifts in project initialization and archive handling [1]. The uv init command now defines a build system by default and uses uv_build [1]. Additionally, uv has tightened its acceptance of package formats by rejecting legacy source distributions in .tar.bz2 and .tar.xz formats and only supporting .tar.gz [1]. Wheels can no longer use bzip2, LZMA, or XZ compression methods, and wheel entry points that could overwrite the Python interpreter are now rejected [1].
Dependency resolution and security validation have been substantially strengthened [1]. The pre-release mode default has shifted to if-necessary, prioritizing stable versions over pre-release versions [1]. The --require-hashes flag now enforces hash checking, and MD5-only hashes are rejected in hash-checking mode [1]. The pylock.toml file must now include a packages array [1]. Further safeguards include requiring SSL_CERT_FILE or SSL_CERT_DIR environment variable overrides to be valid, support for pip-compatible --cert parameters, a requirement for the --force flag before clearing non-venv directories, and rejection of the --project flag when initializing a project [1].