VAULT2077
Vault 资讯瀑布官方2026.10.09 04:06 UTC+8

astral-sh/uv 发布 0.12.24

uv 0.12.24 发布：uv cache prune 清理孤立临时构建环境、PEP 508 标记运算符、uv audit 优先显示 PYSEC/GHSA/CVE 等多项改进。

中文处理结果

发布说明

发布于 2026-10-08。

增强

  • 使用 uv cache prune 移除孤立的临时构建环境（#22171）
  • 允许 PEP 508 标记运算符直接出现在分组表达式之前（#22309）
  • 拒绝格式错误的 requirements 文件选项，而不是部分解析或忽略它们（#22317）
  • 在托管 Python 卸载失败时显示底层文件系统与注册表错误（#22362）
  • 在 Python 镜像错误中标识出无效的源 URL（#22364）

预览功能

  • 在 uv audit 报告中显示首选公告 ID，优先顺序为 PYSEC、GHSA，然后是 CVE 标识符（#22292）

配置

  • 支持 GraalPy 的自定义安装镜像（#22269）
  • 支持 Pyodide 的自定义安装镜像（#22271）
  • 允许 UV_NO_CACHE=false 覆盖配置中的 no-cache = true（#22324）
  • 对无效的 trusted-host 端口和预览功能列表条目报告更精确的错误位置（#22144）

性能

  • 通过预热解释器缓存，加快创建环境后的后续命令（#21304）
  • 通过 16 KiB 签名页减少 ARM64 macOS 版本的代码签名验证工作（#22246）
  • 使用 astral-html 解析包索引和 --find-links 页面时强制执行资源限制（#22203）
  • 通过省略未使用的 Zstandard 支持，将独立 uv-build 可执行文件体积减少 7.5%（#22242）
  • 通过简化配置反序列化，将 uv 的二进制体积减少约 232 KB（#22144）
  • 通过共享格式化器，减少 Python 下载错误格式化代码的体积（#22141）

缺陷修复

原始正文

astral-sh/uv released 0.12.24

Release Notes

Released on 2026-10-08.

Enhancements

  • Remove orphaned temporary build environments with uv cache prune (#22171)
  • Accept PEP 508 marker operators directly before grouped expressions (#22309)
  • Reject malformed requirements-file options instead of partially parsing or ignoring them (#22317)
  • Show underlying filesystem and registry errors when managed Python uninstallation fails (#22362)
  • Identify the invalid source URL in Python mirror errors (#22364)

Preview features

  • Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#22292)

Configuration

  • Support custom installation mirrors for GraalPy (#22269)
  • Support custom installation mirrors for Pyodide (#22271)
  • Allow UV_NO_CACHE=false to override no-cache = true in configuration (#22324)
  • Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#22144)

Performance

  • Speed up later commands after creating an environment by warming its interpreter cache (#21304)
  • Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#22246)
  • Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#22203)
  • Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support (#22242)
  • Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (#22144)
  • Reduce Python download error formatting code size by sharing its formatter (#22141)

Bug fixes

  • Verify supplied hashes even when hash presence is disabled with --no-require-hashes or require-hashes = false (#22369)
  • Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (#22360)
  • Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (#22237)
  • Exclude optional dependencies from exports when their extras are activated only in incompatible environments (#22234)
  • Give explicit uv publish --trusted-publishing values precedence over configuration (#22279)
  • Allow UV_OFFLINE=false to override offline = true in configuration (#22283)
  • Allow UV_SYSTEM_CERTS=false to override system-certs = true in configuration (#22291)
  • Allow uv auth login over IPv6 loopback addresses (#22306)
  • Resolve GitHub dependencies whose Git references contain # or % characters (#22281)
  • Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (#22322)
  • Preserve JSON output from uv version and uv self version with a single --quiet flag (#22280)
  • Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (#22284)
  • Restore wheel incompatibility hints when WHEEL metadata contains multiple expanded Tag: rows (#22235)
  • Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (#22302)
  • Prevent workspace-cache assertion failures after modifying a project at the workspace root (#22236)
  • Hide the ignored --keyring-provider option from uv auth help (#19520)
  • Report HTTP client setup failures directly when resolving unnamed uv tool requirements (#22320)

Documentation

  • Update Docker and AWS Lambda examples to cache dependency layers using frozen lockfiles without project manifests (#22172)
  • Fix stale links and descriptions in Rust crate documentation (#22311, #22361)
  • Fix a typo in the required-environments documentation (#22238)

Install uv 0.12.24

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.ps1 | iex"

Download uv 0.12.24

FilePlatformChecksum
uv-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
uv-x86_64-apple-darwin.tar.gzIntel macOSchecksum
uv-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
uv-i686-pc-windows-msvc.zipx86 Windowschecksum
uv-x86_64-pc-windows-msvc.zipx64 Windowschecksum
uv-aarch64-unknown-linux-gnu.tar.gzARM64 Linuxchecksum
uv-i686-unknown-linux-gnu.tar.gzx86 Linuxchecksum
uv-powerpc64le-unknown-linux-gnu.tar.gzPPC64LE Linuxchecksum
uv-riscv64gc-unknown-linux-gnu.tar.gzRISCV Linuxchecksum
uv-s390x-unknown-linux-gnu.tar.gzS390x Linuxchecksum
uv-x86_64-unknown-linux-gnu.tar.gzx64 Linuxchecksum
uv-armv7-unknown-linux-gnueabihf.tar.gzARMv7 Linuxchecksum
uv-aarch64-unknown-linux-musl.tar.gzARM64 MUSL Linuxchecksum
uv-i686-unknown-linux-musl.tar.gzx86 MUSL Linuxchecksum
uv-riscv64gc-unknown-linux-musl.tar.gzRISCV MUSL Linuxchecksum
uv-x86_64-unknown-linux-musl.tar.gzx64 MUSL Linuxchecksum
uv-arm-unknown-linux-musleabihf.tar.gzARMv6 MUSL Linux (Hardfloat)checksum
uv-armv7-unknown-linux-musleabihf.tar.gzARMv7 MUSL Linuxchecksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
查看原始发布