uv patched four supply chain bugs in two days

Astral shipped two uv releases back to back, both fixing supply chain issues in the Python package installer most agent-built projects now default to. Version 0.12.9, released September 1, fixes a memory-safety bug in async_http_range_reader that surfaced when reading metadata ranges from untrusted wheels, per the release notes. It also strips sensitive headers when a redirect crosses an authentication boundary, including same-host scheme changes, and redacts secrets from signed URLs before they show up in retry diagnostics.

The day before, 0.12.8 closed a narrower gap. Under --require-hashes, uv had been trusting hashes for direct URLs when those hashes came only from wheel metadata rather than a lockfile or requirements pin. That's the kind of gap a malicious package index or a compromised mirror could exploit, since wheel metadata is exactly what an attacker controls.

None of these are exploited-in-the-wild disclosures. They read more like the kind of bugs a security review or fuzzing pass turns up before anyone weaponizes them. But uv's install path runs inside CI, inside containers, and increasingly inside coding agents that pull dependencies without a human reading each diff first. A header leak across a redirect or a hash check that trusts the wrong source matters more when nobody's watching the terminal.

If you're pinning uv in a Dockerfile or CI config, 0.12.9 is the version to move to. The release notes don't say whether earlier 0.12.x builds are affected by all four issues or just some of them, so treat anything before 0.12.8 as unverified rather than assuming it's fine.