astral-sh/uv 发布 0.12.18
uv 0.12.18 修复 Windows 安装 wheel 时的路径穿越漏洞，并为 pip install/sync 新增 JSON 输出与 --check。
中文处理结果
发布说明
发布于 2026-09-22。
本次发布修复了 GHSA-2cv4-cqwr-gwf7，这是 Windows 上安装 wheel 时存在的路径穿越弱点。其他平台不受该公告影响。
增强
- 为
uv pip install和uv pip sync添加--output-format json，包括用于--dry-run和--check时（#21893） - 为
uv pip install和uv pip sync添加--check，在不修改环境的情况下报告计划中的变更（#21844） - 在构建错误中正确识别来自
get_requires_for_build_*钩子的失败（#21881）
预览功能
- 通过
--preview-features build-dependency-check为uv build --no-build-isolation校验构建依赖；使用--skip-dependency-check可退出该检查（#21880）
性能
- 通过省略临时 wheel 的压缩，加快
uv_build可编辑 wheel 的创建（#21918）
缺陷修复
- 为每个 Python 解析分支选择具有兼容 wheel 的包版本，正确解释通用与稳定 ABI 的 wheel 标签（#21835、#21836）
- 当
uv add、uv remove或uv version失败或被中断时，恢复项目、脚本和锁文件（#21860、#21856） - 在检查已安装依赖是否满足时，使用配置的
dependency-metadata（#21843） - 拒绝规范化后为绝对 Windows 路径的归档条目（#21923）
- 当 URL 片段包含
?时，正确识别发行版文件名和归档扩展名（#21920） - 为 BSD 和 Haiku 发行版生成正确小写的平台标签（#21853）
- 避免将 Windows 相对路径重建为绝对形式（#21923）
安装 uv 0.12.18
通过 shell 脚本安装预构建二进制文件
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh
通过 powershell 脚本安装预构建二进制文件
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex"
下载 uv 0.12.18
原始正文
astral-sh/uv released 0.12.18
Release Notes
Released on 2026-09-22.
This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.
Enhancements
- Add
--output-format jsontouv pip installanduv pip sync, including for--dry-runand--check(#21893) - Add
--checktouv pip installanduv pip syncto report planned changes without modifying the environment (#21844) - Identify failures from
get_requires_for_build_*hooks correctly in build errors (#21881)
Preview features
- Validate build requirements for
uv build --no-build-isolationwith--preview-features build-dependency-check; use--skip-dependency-checkto opt out (#21880)
Performance
- Speed up
uv_buildeditable wheel creation by omitting compression from temporary wheels (#21918)
Bug fixes
- Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
- Restore project, script, and lock files when
uv add,uv remove, oruv versionfails or is interrupted (#21860, #21856) - Use configured
dependency-metadatawhen checking whether installed requirements are satisfied (#21843) - Reject archive entries that normalize to absolute Windows paths (#21923)
- Recognize distribution filenames and archive extensions when URL fragments contain
?(#21920) - Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
- Avoid rebuilding a Windows relative path into an absolute form (#21923)
Install uv 0.12.18
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex"
Download uv 0.12.18
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv
You can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>