Tools
uv 0.12.12 code-signs and notarizes its release binaries, and stops exclude-newer leaking into hashes
Released 2026-09-09, uv now signs macOS executables with an Apple Developer ID certificate and notarizes them, and gives Windows executables timestamped Authenticode signatures from Azure Artifact Signing, covering the release archives and the `uv` and `uv_build` wheels. The stated goals are publisher verification, publisher-based allowlisting, and fewer antivirus false positives. The single bug fix (#21539) excludes distributions uploaded after the `exclude-newer` cutoff from lockfiles and generated requirement hashes, which previously made a pinned cutoff produce a lockfile that disagreed with itself.
Source
↳ Follow the thread