Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-30 · high
The same release turns --require-hashes into real hash-checking mode and rejects MD5-only pins in requirements.txt.
Why now: Astral released uv 0.12.0 on July 28, and the hash-enforcement change needs a check before your next uv sync.
Astral shipped uv 0.12.0 on July 28, changing what uv init builds by default.
Run uv init example now and the tool scaffolds a packaged src/example layout with uv_build as the build system, not the flat directory it used before. The project can be installed as a dependency and its entry points run as commands without extra setup, per the release notes. --no-package is the opt-out, and any template or script built around the old flat layout needs it now.
That's the change people will notice first. The one to act on is quieter.
--require-hashes in requirements.txt used to work more like a suggestion. In 0.12.0 it enforces real hash-checking mode, and it rejects MD5-only hashes outright. Source distributions also have to ship as .tar.gz under PEP 625. Prerelease preference moved to an if-necessary policy, and uv run now resolves scripts starting from the script's own directory instead of the working directory.
If a lockfile or requirements.txt still lists MD5 hashes, and a CI job passes --require-hashes assuming it's already strict, this release breaks that assumption. The flag used to tolerate weak hashes. Now it doesn't, and installs that depended on the old lax behavior fail instead of passing quietly.
The layout default is a workflow change. The hash enforcement is a security posture change, bundled into the same release.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source / Earlier coverage
Both cover Astral, July, MD5, PEP; cite the same source (Astral shipped 0.12.0 on July 28); earlier Astral coverage from 2026-07-29.
OpenAI acquired Astral / Shared entity: July / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (OpenAI acquired Astral); both cover July; reported by the same outlet (github.com).
Astral released Ruff / Shared entities / Earlier coverage
Linked by a graph relationship (Astral released Ruff); both cover Astral, July; earlier Astral coverage from 2026-07-26.
OpenAI acquired Astral / Shared entity: July / Same source domain / Earlier coverage
Linked by a graph relationship (OpenAI acquired Astral); both cover July; reported by the same outlet (github.com).
Linked by a graph relationship (OpenAI acquired Astral); both cover July; reported by the same outlet (github.com).
Linked by a graph relationship (OpenAI acquired Astral); both cover July; reported by the same outlet (github.com).
Linked by a graph relationship (OpenAI acquired Astral); both cover July; reported by the same outlet (github.com).
OpenAI acquired Astral / Shared entity: July / Earlier coverage / Tension
Linked by a graph relationship (OpenAI acquired Astral); both cover July; earlier July coverage from 2026-07-26.