uv 0.12.10 revokes short-lived PyPI trusted-publishing tokens after uv publish, including when publishing fails
GitHub·medium signal
The 2026-09-04 release adds token revocation on the way out of `uv publish` (#21423), closing the window where a short-lived trusted-publishing token stays valid after a failed upload in CI. The same release speeds up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#21399), and requires an explicit `--name` when `uv init` would infer a project name reserved for a Python interpreter (#21395).