Tools
uv 0.12.9 patches a memory-safety issue reading metadata ranges from untrusted wheels
Released 2026-09-01, uv 0.12.9 updates `async_http_range_reader` to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401), removes sensitive headers when redirects cross authentication realms including same-host redirects that change URL scheme (#21382), and redacts secrets in signed URLs from retry diagnostics (#21381). The prior day's 0.12.8 stopped trusting hashes from direct URLs discovered only in wheel metadata under `--require-hashes` (#21348). Four supply-chain hardening fixes in two days on the installer most agent-built Python projects now use.
Source
↳ Follow the thread