uv 0.12.0 defaults new projects to packaged src layout

Astral shipped uv 0.12.0 on July 28, changing what uv init builds by default.

Run uv init example now and the tool scaffolds a packaged src/example layout with uv_build as the build system, not the flat directory it used before. The project can be installed as a dependency and its entry points run as commands without extra setup, per the release notes. --no-package is the opt-out, and any template or script built around the old flat layout needs it now.

That's the change people will notice first. The one to act on is quieter.

--require-hashes in requirements.txt used to work more like a suggestion. In 0.12.0 it enforces real hash-checking mode, and it rejects MD5-only hashes outright. Source distributions also have to ship as .tar.gz under PEP 625. Prerelease preference moved to an if-necessary policy, and uv run now resolves scripts starting from the script's own directory instead of the working directory.

The hash change has teeth

If a lockfile or requirements.txt still lists MD5 hashes, and a CI job passes --require-hashes assuming it's already strict, this release breaks that assumption. The flag used to tolerate weak hashes. Now it doesn't, and installs that depended on the old lax behavior fail instead of passing quietly.

The layout default is a workflow change. The hash enforcement is a security posture change, bundled into the same release.