uv 0.12.11 checks archive hashes before running any build code

uv 0.12.11 now checks a downloaded source archive against the hash recorded in uv.lock before running that archive's build backend. Before this release, uv read the archive for metadata and ran its build backend first, then checked the hash after, per the 0.12.11 release notes.

That ordering defeats the point of pinning hashes. A lockfile hash is supposed to guarantee you're installing the exact code someone reviewed, not whatever a compromised mirror or a swapped PyPI upload handed you instead. If the tool executes that code before checking whether it matches, the hash isn't a gate. It's a record you check after the fact.

The same release extends hash verification to registry requirements pinned with the === operator, under both the --verify-hashes and --require-hashes flags. Exact-version pins were missing coverage that ranged pins already had.

If you run uv in CI or anywhere that installs from a lockfile as a security boundary, this is worth pulling in now. Anyone relying on --require-hashes to block untrusted installs was getting less protection than the flag's name promised.