uv 0.12.0 Makes Packaged src/ Layout the Default for uv init and Turns --require-hashes Into Real Hash-Checking Mode
Astral shipped uv 0.12.0 on July 28 with breaking changes that will silently alter new-project scaffolding: `uv init example` now generates a packaged `src/example` layout with `uv_build` declared as the build system, so applications can be installed as dependencies and run as commands, with `uv init --no-package` as the opt-out. Source distributions must now be `.tar.gz` per PEP 625 (`.tar.bz2` and `.tar.xz` are rejected, `.zip` still accepted), `--require-hashes` in requirements.txt now enforces hash-checking mode outright, MD5-only hashes are rejected there, prerelease preference moved to `if-necessary`, and `uv run` script discovery now starts from the script's own directory. The supply-chain tightening is the part worth acting on today if you pin dependencies by hash.
↳ Follow the thread