uv 0.12.0 Makes Every uv init Project a Packaged Build and Rejects .tar.bz2 and .tar.xz Sdists
Astral shipped uv 0.12.0 on 2026-07-28 with several breaking changes worth reading before upgrading. Projects created by uv init now declare a build system and are packaged by default using uv_build, with source under src/ and console scripts generated. Source distributions must be .tar.gz per PEP 625, so .tar.bz2 and .tar.xz are rejected, and wheel compression is limited to stored, DEFLATE or zstd. Pre-release resolution now defaults to if-necessary, matching pip's behavior for transitive dependencies. Security hardening blocks wheels that would overwrite a Python interpreter (including case variants like Python.exe), rejects MD5-only hashes under --require-hashes, and makes empty or invalid SSL_CERT_FILE/SSL_CERT_DIR fail HTTPS rather than silently falling back to defaults.
↳ Follow the thread