Uv 0.12.0 发布

Astral 于 2026 年 7 月 28 日发布了 Python 包管理工具 uv 的 0.12.0 版本1。此版本包含多项破坏性变更，但大多数用户无需修改即可升级1。

在构建系统方面，uv init 现在默认定义 build system 并使用 uv_build1。安全性方面的改进包括：拒绝 legacy 格式源代码分发文件（.tar.bz2、.tar.xz），仅支持 .tar.gz1；wheels 不再支持 bzip2、LZMA、XZ 压缩方法1；拒绝可能覆盖 Python 解释器的 wheel entry points1；在哈希检查模式下拒绝仅含 MD5 哈希值的文件1。

依赖解析逻辑也进行了调整，默认 pre-release 模式改为 if-necessary，优先使用稳定版本而非预发布版本1。此外，--require-hashes 参数现在强制启用哈希检查1，pylock.toml 必须包含 packages 数组1，SSL_CERT_FILE 或 SSL_CERT_DIR 覆盖必须有效1，新增支持 pip 兼容的 --cert 参数1。在项目操作方面，清空非虚拟环境目录需要 --force 参数1，初始化项目时不再允许使用 --project 参数1。

Astral has released version 0.12.0 of uv, its Python package management tool, on July 28, 2026 1. The update introduces several breaking changes designed to enhance security and improve dependency resolution behavior, though most users can upgrade without modification 1.

The new version makes significant shifts in project initialization and archive handling 1. The uv init command now defines a build system by default and uses uv_build 1. Additionally, uv has tightened its acceptance of package formats by rejecting legacy source distributions in .tar.bz2 and .tar.xz formats and only supporting .tar.gz 1. Wheels can no longer use bzip2, LZMA, or XZ compression methods, and wheel entry points that could overwrite the Python interpreter are now rejected 1.

Dependency resolution and security validation have been substantially strengthened 1. The pre-release mode default has shifted to if-necessary, prioritizing stable versions over pre-release versions 1. The --require-hashes flag now enforces hash checking, and MD5-only hashes are rejected in hash-checking mode 1. The pylock.toml file must now include a packages array 1. Further safeguards include requiring SSL_CERT_FILE or SSL_CERT_DIR environment variable overrides to be valid, support for pip-compatible --cert parameters, a requirement for the --force flag before clearing non-venv directories, and rejection of the --project flag when initializing a project 1.