diff --git a/CHANGELOG.md b/CHANGELOG.md index 2afe6afa2..47670ab70 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,47 @@ +## 0.9.6 + +Released on 2025-10-29. + +This release contains an upgrade to Astral's fork of `async_zip`, which addresses potential sources of ZIP parsing differentials between uv and other Python packaging tooling. See [GHSA-pqhf-p39g-3x64](https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64) for additional details. + +### Security + +* Address ZIP parsing differentials ([GHSA-pqhf-p39g-3x64](https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64)) + +### Python + +- Upgrade GraalPy to 25.0.1 ([#16401](https://github.com/astral-sh/uv/pull/16401)) + +### Enhancements + +- Add `--clear` to `uv build` to remove old build artifacts ([#16371](https://github.com/astral-sh/uv/pull/16371)) +- Add `--no-create-gitignore` to `uv build` ([#16369](https://github.com/astral-sh/uv/pull/16369)) +- Do not error when a virtual environment directory cannot be removed due to a busy error ([#16394](https://github.com/astral-sh/uv/pull/16394)) +- Improve hint on `pip install --system` when externally managed ([#16392](https://github.com/astral-sh/uv/pull/16392)) +- Running `uv lock --check` with outdated lockfile will print that `--check` was passed, instead of `--locked` ([#16322](https://github.com/astral-sh/uv/pull/16322)) +- Update `uv init` template for Maturin ([#16449](https://github.com/astral-sh/uv/pull/16449)) +- Improve ordering of Python sources in logs ([#16463](https://github.com/astral-sh/uv/pull/16463)) +- Restore DockerHub release images and annotations ([#16441](https://github.com/astral-sh/uv/pull/16441)) + +### Bug fixes + +- Check for matching Python implementation during `uv python upgrade` ([#16420](https://github.com/astral-sh/uv/pull/16420)) +- Deterministically order `--find-links` distributions ([#16446](https://github.com/astral-sh/uv/pull/16446)) +- Don't panic in `uv export --frozen` when the lockfile is outdated ([#16407](https://github.com/astral-sh/uv/pull/16407)) +- Fix root of `uv tree` when `--package` is used with circular dependencies ([#15908](https://github.com/astral-sh/uv/pull/15908)) +- Show package list with `pip freeze --quiet` ([#16491](https://github.com/astral-sh/uv/pull/16491)) +- Limit `uv auth login pyx.dev` retries to 60s ([#16498](https://github.com/astral-sh/uv/pull/16498)) +- Add an empty group with `uv add --group ... -r ...` ([#16490](https://github.com/astral-sh/uv/pull/16490)) + +### Documentation + +- Update docs for maturin build backend init template ([#16469](https://github.com/astral-sh/uv/pull/16469)) +- Update docs to reflect previous changes to signal forwarding semantics ([#16430](https://github.com/astral-sh/uv/pull/16430)) +- Add instructions for installing via MacPorts ([#16039](https://github.com/astral-sh/uv/pull/16039)) + ## 0.9.5 Released on 2025-10-21. diff --git a/Cargo.lock b/Cargo.lock index 1ffa30163..9aac5cad3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5168,7 +5168,7 @@ dependencies = [ [[package]] name = "uv" -version = "0.9.5" +version = "0.9.6" dependencies = [ "anstream", "anyhow", @@ -5379,7 +5379,7 @@ dependencies = [ [[package]] name = "uv-build" -version = "0.9.5" +version = "0.9.6" dependencies = [ "anstream", "anyhow", @@ -6669,7 +6669,7 @@ dependencies = [ [[package]] name = "uv-version" -version = "0.9.5" +version = "0.9.6" [[package]] name = "uv-virtualenv" diff --git a/crates/uv-build/Cargo.toml b/crates/uv-build/Cargo.toml index f5588374e..0eb2629e7 100644 --- a/crates/uv-build/Cargo.toml +++ b/crates/uv-build/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "uv-build" -version = "0.9.5" +version = "0.9.6" edition = { workspace = true } rust-version = { workspace = true } homepage = { workspace = true } diff --git a/crates/uv-build/pyproject.toml b/crates/uv-build/pyproject.toml index 675b1bee1..0a775183f 100644 --- a/crates/uv-build/pyproject.toml +++ b/crates/uv-build/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "uv-build" -version = "0.9.5" +version = "0.9.6" description = "The uv build backend" authors = [{ name = "Astral Software Inc.", email = "hey@astral.sh" }] requires-python = ">=3.8" diff --git a/crates/uv-version/Cargo.toml b/crates/uv-version/Cargo.toml index ec1ff1a28..e99dd3d9f 100644 --- a/crates/uv-version/Cargo.toml +++ b/crates/uv-version/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "uv-version" -version = "0.9.5" +version = "0.9.6" edition = { workspace = true } rust-version = { workspace = true } homepage = { workspace = true } diff --git a/crates/uv/Cargo.toml b/crates/uv/Cargo.toml index cd5643082..f807c9214 100644 --- a/crates/uv/Cargo.toml +++ b/crates/uv/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "uv" -version = "0.9.5" +version = "0.9.6" edition = { workspace = true } rust-version = { workspace = true } homepage = { workspace = true } diff --git a/docs/concepts/build-backend.md b/docs/concepts/build-backend.md index acb2bac02..e4e21b228 100644 --- a/docs/concepts/build-backend.md +++ b/docs/concepts/build-backend.md @@ -31,7 +31,7 @@ To use uv as a build backend in an existing project, add `uv_build` to the ```toml title="pyproject.toml" [build-system] -requires = ["uv_build>=0.9.5,<0.10.0"] +requires = ["uv_build>=0.9.6,<0.10.0"] build-backend = "uv_build" ``` diff --git a/docs/concepts/projects/init.md b/docs/concepts/projects/init.md index 35a397f0c..42e39ba7b 100644 --- a/docs/concepts/projects/init.md +++ b/docs/concepts/projects/init.md @@ -111,7 +111,7 @@ dependencies = [] example-pkg = "example_pkg:main" [build-system] -requires = ["uv_build>=0.9.5,<0.10.0"] +requires = ["uv_build>=0.9.6,<0.10.0"] build-backend = "uv_build" ``` @@ -134,7 +134,7 @@ dependencies = [] example-pkg = "example_pkg:main" [build-system] -requires = ["uv_build>=0.9.5,<0.10.0"] +requires = ["uv_build>=0.9.6,<0.10.0"] build-backend = "uv_build" ``` @@ -195,7 +195,7 @@ requires-python = ">=3.11" dependencies = [] [build-system] -requires = ["uv_build>=0.9.5,<0.10.0"] +requires = ["uv_build>=0.9.6,<0.10.0"] build-backend = "uv_build" ``` diff --git a/docs/concepts/projects/workspaces.md b/docs/concepts/projects/workspaces.md index 326f3147e..0aec42cd9 100644 --- a/docs/concepts/projects/workspaces.md +++ b/docs/concepts/projects/workspaces.md @@ -75,7 +75,7 @@ bird-feeder = { workspace = true } members = ["packages/*"] [build-system] -requires = ["uv_build>=0.9.5,<0.10.0"] +requires = ["uv_build>=0.9.6,<0.10.0"] build-backend = "uv_build" ``` @@ -106,7 +106,7 @@ tqdm = { git = "https://github.com/tqdm/tqdm" } members = ["packages/*"] [build-system] -requires = ["uv_build>=0.9.5,<0.10.0"] +requires = ["uv_build>=0.9.6,<0.10.0"] build-backend = "uv_build" ``` @@ -188,7 +188,7 @@ dependencies = ["bird-feeder", "tqdm>=4,<5"] bird-feeder = { path = "packages/bird-feeder" } [build-system] -requires = ["uv_build>=0.9.5,<0.10.0"] +requires = ["uv_build>=0.9.6,<0.10.0"] build-backend = "uv_build" ``` diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md index 98a860ec8..037468020 100644 --- a/docs/getting-started/installation.md +++ b/docs/getting-started/installation.md @@ -25,7 +25,7 @@ uv provides a standalone installer to download and install uv: Request a specific version by including it in the URL: ```console - $ curl -LsSf https://astral.sh/uv/0.9.5/install.sh | sh + $ curl -LsSf https://astral.sh/uv/0.9.6/install.sh | sh ``` === "Windows" @@ -41,7 +41,7 @@ uv provides a standalone installer to download and install uv: Request a specific version by including it in the URL: ```pwsh-session - PS> powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/0.9.5/install.ps1 | iex" + PS> powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/0.9.6/install.ps1 | iex" ``` !!! tip diff --git a/docs/guides/integration/aws-lambda.md b/docs/guides/integration/aws-lambda.md index 4beefeb2a..4893fcc6a 100644 --- a/docs/guides/integration/aws-lambda.md +++ b/docs/guides/integration/aws-lambda.md @@ -92,7 +92,7 @@ the second stage, we'll copy this directory over to the final image, omitting th other unnecessary files. ```dockerfile title="Dockerfile" -FROM ghcr.io/astral-sh/uv:0.9.5 AS uv +FROM ghcr.io/astral-sh/uv:0.9.6 AS uv # First, bundle the dependencies into the task root. FROM public.ecr.aws/lambda/python:3.13 AS builder @@ -334,7 +334,7 @@ And confirm that opening http://127.0.0.1:8000/ in a web browser displays, "Hell Finally, we'll update the Dockerfile to include the local library in the deployment package: ```dockerfile title="Dockerfile" -FROM ghcr.io/astral-sh/uv:0.9.5 AS uv +FROM ghcr.io/astral-sh/uv:0.9.6 AS uv # First, bundle the dependencies into the task root. FROM public.ecr.aws/lambda/python:3.13 AS builder diff --git a/docs/guides/integration/docker.md b/docs/guides/integration/docker.md index 310955fb5..c1f4de44c 100644 --- a/docs/guides/integration/docker.md +++ b/docs/guides/integration/docker.md @@ -31,7 +31,7 @@ $ docker run --rm -it ghcr.io/astral-sh/uv:debian uv --help The following distroless images are available: - `ghcr.io/astral-sh/uv:latest` -- `ghcr.io/astral-sh/uv:{major}.{minor}.{patch}`, e.g., `ghcr.io/astral-sh/uv:0.9.5` +- `ghcr.io/astral-sh/uv:{major}.{minor}.{patch}`, e.g., `ghcr.io/astral-sh/uv:0.9.6` - `ghcr.io/astral-sh/uv:{major}.{minor}`, e.g., `ghcr.io/astral-sh/uv:0.8` (the latest patch version) @@ -95,7 +95,7 @@ And the following derived images are available: As with the distroless image, each derived image is published with uv version tags as `ghcr.io/astral-sh/uv:{major}.{minor}.{patch}-{base}` and -`ghcr.io/astral-sh/uv:{major}.{minor}-{base}`, e.g., `ghcr.io/astral-sh/uv:0.9.5-alpine`. +`ghcr.io/astral-sh/uv:{major}.{minor}-{base}`, e.g., `ghcr.io/astral-sh/uv:0.9.6-alpine`. In addition, starting with `0.8` each derived image also sets `UV_TOOL_BIN_DIR` to `/usr/local/bin` to allow `uv tool install` to work as expected with the default user. @@ -136,7 +136,7 @@ Note this requires `curl` to be available. In either case, it is best practice to pin to a specific uv version, e.g., with: ```dockerfile -COPY --from=ghcr.io/astral-sh/uv:0.9.5 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.9.6 /uv /uvx /bin/ ``` !!! tip @@ -154,7 +154,7 @@ COPY --from=ghcr.io/astral-sh/uv:0.9.5 /uv /uvx /bin/ Or, with the installer: ```dockerfile -ADD https://astral.sh/uv/0.9.5/install.sh /uv-installer.sh +ADD https://astral.sh/uv/0.9.6/install.sh /uv-installer.sh ``` ### Installing a project @@ -590,5 +590,5 @@ Verified OK !!! tip These examples use `latest`, but best practice is to verify the attestation for a specific - version tag, e.g., `ghcr.io/astral-sh/uv:0.9.5`, or (even better) the specific image digest, + version tag, e.g., `ghcr.io/astral-sh/uv:0.9.6`, or (even better) the specific image digest, such as `ghcr.io/astral-sh/uv:0.5.27@sha256:5adf09a5a526f380237408032a9308000d14d5947eafa687ad6c6a2476787b4f`. diff --git a/docs/guides/integration/github.md b/docs/guides/integration/github.md index 1024b5125..6b6f4e86d 100644 --- a/docs/guides/integration/github.md +++ b/docs/guides/integration/github.md @@ -47,7 +47,7 @@ jobs: uses: astral-sh/setup-uv@v6 with: # Install a specific version of uv. - version: "0.9.5" + version: "0.9.6" ``` ## Setting up Python diff --git a/docs/guides/integration/pre-commit.md b/docs/guides/integration/pre-commit.md index 431fe9d1a..fceaf382d 100644 --- a/docs/guides/integration/pre-commit.md +++ b/docs/guides/integration/pre-commit.md @@ -19,7 +19,7 @@ To make sure your `uv.lock` file is up to date even if your `pyproject.toml` fil repos: - repo: https://github.com/astral-sh/uv-pre-commit # uv version. - rev: 0.9.5 + rev: 0.9.6 hooks: - id: uv-lock ``` @@ -30,7 +30,7 @@ To keep a `requirements.txt` file in sync with your `uv.lock` file: repos: - repo: https://github.com/astral-sh/uv-pre-commit # uv version. - rev: 0.9.5 + rev: 0.9.6 hooks: - id: uv-export ``` @@ -41,7 +41,7 @@ To compile requirements files: repos: - repo: https://github.com/astral-sh/uv-pre-commit # uv version. - rev: 0.9.5 + rev: 0.9.6 hooks: # Compile requirements - id: pip-compile @@ -54,7 +54,7 @@ To compile alternative requirements files, modify `args` and `files`: repos: - repo: https://github.com/astral-sh/uv-pre-commit # uv version. - rev: 0.9.5 + rev: 0.9.6 hooks: # Compile requirements - id: pip-compile @@ -68,7 +68,7 @@ To run the hook over multiple files at the same time, add additional entries: repos: - repo: https://github.com/astral-sh/uv-pre-commit # uv version. - rev: 0.9.5 + rev: 0.9.6 hooks: # Compile requirements - id: pip-compile diff --git a/pyproject.toml b/pyproject.toml index f7de573dd..601d70f2e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "maturin" [project] name = "uv" -version = "0.9.5" +version = "0.9.6" description = "An extremely fast Python package and project manager, written in Rust." authors = [{ name = "Astral Software Inc.", email = "hey@astral.sh" }] requires-python = ">=3.8" diff --git a/scripts/release.sh b/scripts/release.sh index dc225316e..0211b2d6f 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -11,7 +11,7 @@ echo "Updating metadata with rooster..." cd "$project_root" # Update the changelog -uvx --python 3.12 rooster@0.1.0 release "$@" +uvx --python 3.12 rooster@0.1.1 release "$@" echo "Updating lockfile..." cargo update -p uv