Update charmcraft.yaml build tools

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Update
poetry (changelog)	2.4.3 → 2.5.1			minor
poetry-plugin-export	1.10.0 → 1.10.1			patch
rust-lang/rust	1.98.1 → 1.99.0			minor
uv (source, changelog)	0.12.10 → 0.13.0			minor

---

Release Notes

python-poetry/poetry (poetry)

v2.5.1

Compare Source

Fixed

• Fix an issue where uninstalling a package with installer.builtin-uninstall set failed with a TypeError (#​11077).

v2.5.0

Compare Source

Added

• Add an installer.builtin-uninstall setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall (#​10931).
• Add official support for Python 3.15 (#​11046).

Changed

• Do not send credentials configured for an https repository via http (#​11073).
• Fail with an error when the current Python version is not compatible with the project and virtualenvs.create is false (#​10941).
• Validate version constraints that are entered interactively in poetry init (#​10909).
• Include the path of the pyproject.toml file in the message about already present packages in poetry add (#​10908).
• Improve performance of processing package links and repository pages (#​10895,
  #​10896,
  #​10903,
  #​10949,
  #​10951,
  #​10953).
• Improve performance of dependency resolution (#​10907,
  #​10954).
• Improve performance of choosing and installing wheels (#​10905,
  #​10958).
• Improve performance by avoiding redundant keyring lookups for repositories without credentials (#​10959).
• Improve performance by reducing the number of subprocesses to discover virtual environment data (#​11042).
• Improve performance of poetry search for single-token queries (#​10906).
• Improve startup time by deferring the import of requests (#​11004).
• Improve performance of schema validation by caching compiled JSON schema validators (#​11033).

Fixed

• Fix an issue where credentials of the wrong repository were used under certain circumstances when multiple repositories were configured on the same host (#​11072).
• Fix an issue where credentials of a repository on another host were used for git dependencies if the path of the URL was the same (#​11074).
• Fix an issue where dependency resolution failed for conflicting requirements of different packages even though the requirements had mutually exclusive markers (#​10944).
• Fix an issue where dependency resolution failed when the same package was required with different extras in several optional dependencies or dependency groups (#​10943).
• Fix an issue where dependency resolution failed with a KeyError (#​11008).
• Fix an issue where the dependencies of an extra were missing in the lock file after adding the extra to a locked dependency, e.g. a git dependency, in the pyproject.toml file (#​10987).
• Fix an issue where a path or git dependency was not reinstalled when its develop setting changed (#​11022).
• Fix an issue where scripts of type file were not installed when installing the project (#​10736).
• Fix an issue where GUI scripts were not installed when installing the project (#​10973).
• Fix an issue where a relative path was written to direct_url.json for path dependencies (#​10917).
• Fix an issue where poetry show <package> showed a version that was not relevant for the current environment if there were multiple versions of the package in the lock file (#​11003).
• Fix an issue where poetry show --outdated did not find newer versions of packages from sources with explicit priority (#​10982).
• Fix an issue where poetry env activate ignored the environment that was determined by the application, e.g. when using --directory (#​10916).
• Fix an issue where poetry init proposed an invalid package name if the directory name was not a valid package name (#​10975).

Docs

• Document the --license option of poetry init and poetry new (#​11064).
• Clarify which dependencies are locked when running poetry update with dependency groups (#​11024).
• Clarify the portability of path dependencies (#​11020).
• Clarify the usage of poetry run with console scripts (#​10984).
• Clarify what --no-cache disables (#​10915).
• Document how to use package sources for poetry self update (#​10923).
• Fix the stale minimum Python version (#​11050).
• Update outdated links (#​10913,
  #​10938,
  #​11000,
  #​11043).

poetry-core (2.5.0)

• Add Python 3.15 to the automatically generated classifiers (#​961).
• Fix an issue where a <V version constraint wrongly allowed pre-releases of V in some cases (#​939).
• Fix an issue where version ranges with coincident bounds were not recognized as empty (#​939).
• Fix an issue where the string representation of a version union did not describe the same constraint after being parsed again (#​939).
• Fix an issue where the intersection of a version range with a local version resulted in a wrong constraint (#​949).
• Fix an issue where the union of a version range and a public version did not include all local versions of the public version (#​950).
• Fix an issue where the union of a public version and one of its local versions did not result in the public version (#​966).
• Fix an issue where the difference between a public version and one of its local versions still allowed the local version, which could result in an infinite loop during dependency resolution (#​953).
• Fix an issue where a version range that excluded some local versions of a public version was wrongly considered to allow all versions of the public version (#​959).
• Fix an issue where a != <value> constraint was wrongly considered to allow all values of a <value> not in constraint (#​955).
• Fix an issue where merging platform_release markers with incompatible constraint types failed (#​956).
• Fix an issue where the string representation of a version range whose upper bound only consists of zeros raised an IndexError (#​964).
• Fix an issue where formatting a Python constraint that only allows unknown Python versions raised an IndexError (#​971).
• Fix an issue where marker values containing spaces could not be parsed (#​972).
• Fix an issue where the upper bound of a ~= constraint was wrong for versions with more than three release segments (#​973).
• Fix an issue where the filename of a link created from a Windows path was wrong and reject filenames containing path separators (#​974).

python-poetry/poetry-plugin-export (poetry-plugin-export)

v1.10.1

Compare Source

Fixed

• Fix export of marker unions with extras (requires poetry-core 2.5.0) (#​365).

rust-lang/rust (rust-lang/rust)

v1.99.0

Compare Source

==========================

Language

• Add allow-by-default raw_borrows_via_references lint that checks for references that decay immediately into raw borrows
• Extend unconditional_panic lint to function calls that panic when the chunks/windows size is zero
• Stabilize C-variadic function definitions
• Stabilize the ability to use #[unsafe(naked)] functions to define C-variadic functions (#![feature(c_variadic_naked_functions)]).
• Trait methods are now resolved on an adjusted never type (producing a FCW)
• Coerce from inference variables to trait objects if the inference variable is related via subtyping to a type that is known to be Sized
• Stabilize #[my_macro] mod foo;. This allows outlined modules (mod foo;) anywhere in the body of a custom attribute or derive macro.
• Fix the overflowing_literals lint with repeated negation. For instance, it will now no longer lint on --128_i8, which is already detected by the arithmetic_overflow lint.
• Add POSIX symbols to the invalid_runtime_symbol_definitions and suspicious_runtime_symbol_definitions lints
• Lint unused #[path] attributes on inline modules
• Enable unreachable_cfg_select_predicates lint as part of unused lint group
• Stabilize passing 128-bit integers via vector registers with asm! on x86
• Explicitly document that some allocations are allowed to grow in-place (but none are allowed to shrink)
• We now guarantee that the contents of an UnsafeCell can be accessed without going through get
  • The invalid_reference_casting lint was adjusted accordingly
• Account for globally enabled target features in global_asm!
• Warn if an invalid doc attribute is used on a macro invocation

Compiler

• Convert -Ctarget-cpu into a target-modifier for AVR, AMDGCN and NVPTX
• Enable static_position_independent_executables on all gnu targets
• When providing a suggestion about a missing method, rustc now prefers an exactly matching name from a doc alias attribute over a similarity search from other method names. If your new users sometimes expect a method under a different name, adding a doc alias will now help them find it via rustc suggestions, in addition to helping them find it via rustdoc search: When suggesting method names, prefer exact doc aliases over similar names

Platform Support

• Promote riscv64-unknown-linux-musl to Tier 2 with host tools

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

• Iteration on RangeInclusive (a..=b ranges) is now optimized better in some circumstances. As a side effect of this, the behavior of RangeInclusive values that has already been exhausted (as an iterator) has changed. For example, the return values of start() and end() on such ranges may return different values, and using such ranges as slice indexes may have different behavior. These behaviors were not guaranteed to be stable, so these changes are considered to not be breaking changes.
• Relax transmute_copy to accept ?Sized types
• Update transmute_copy to use a non-unwinding panic
• Don't escape U+FF9E and U+FF9F in escape_debug_ext
• Re-export core::fmt::NumBuffer in alloc (and std)

Stabilized APIs

• IntoIterator for Box<[T; N]>
• IntoIterator for &Box<[T; N]>
• IntoIterator for &mut Box<[T; N]>
• VecDeque::retain_back
• core::ffi::VaList
• Box::into_non_null
• Box::from_non_null
• Vec::into_parts
• Vec::from_parts
• core::mem::size_of_val_raw
• core::mem::align_of_val_raw
• core::alloc::Layout::for_value_raw
• String::from_utf8_lossy_owned
• string::FromUtf8Error::into_utf8_lossy
• FusedIterator for StepBy<I>
• std::fs::set_times
• std::fs::set_times_nofollow

Cargo

• Add a new built-in profile debug. This is a preparation for transitioning the dev profile away from debugging to give a saner default for faster development iterations. Currently there is no difference between dev and debug profiles. docs #​17214
• Workspace members on edition 2024 or later can now override an inherited workspace dependency's default-features field. For example, serde = { workspace = true, default-features = false } now turns off default features even when the workspace definition enables them. On earlier editions, default-features = false is ignored with a warning. (RFC 3945) #​17126

See also the full Cargo changelog

Rustdoc

• Add new unused_footnote_definition rustdoc lint
• Smarter filtering of trait impls yields performance improvements of 20% on average and up to 40% on some real-world crates. (1, 2, 3, 4, 5)

Compatibility Notes

• Fully deprecate the legacy integral modules. For example, std::i32::MAX should be accessed via i32::MAX instead.
• Upgrade no_mangle_generic_items into hard error
• The Pin::new_unchecked has had its safety invariants changed slightly
• Do not promote references to extern statics
• Ensure that the inferred types of let patterns typecheck
• hermit/fs: Return unsupported() instead of from_raw_os_error(22)
• Fixed a bug where #[repr(simd)] was accidentally allowed on macro invocations on stable Rust
• Abort const-eval when there are generics in the type of the value being produced
• Attributes not applying to anything are now an error in code blocks in doc comments
• Box::leak: tell people to avoid unleaking
• PowerPC inline ASM: Fix scalar floats being in the wrong vector lane on little endian
• Do not take doc(cfg()) into account when filtering doctests
• Infer anonymous lifetimes in the types of associated consts as 'static
• Macros that expand to a semicolon now produce a warning lint (semicolon_in_expressions_from_non_local_macros) even when the macro comes from another crate. Previously, such warnings only appeared for macros from the same crate, to avoid showing warnings that can't be fixed locally; however, this masked problems, as integration tests from the crate providing the macro get compiled as a separate crate, so tests often wouldn't reveal this issue. If you encounter a lint like this, please make sure to report it to the crate providing the macro so they can fix it; don't just silence it in your own crate.
  • semicolon_in_expressions_from_macros: Lint on non-local macros too
  • Split non-local semicolon_in_expressions_from_macros into a separate lint
• In Cargo, incremental compilation is now disabled by default when running in CI. CI is detected via the CI environment variable. #​17220
• The Rust Reference no longer recommends using a single pattern to match a union alongside another value, such as in a manually-written tagged union. This was because it was found that such code would, in some circumstances, result in the compiler reading the contents of the union before checking if the rest of the scrutinee matches the rest of the pattern. This can cause undefined behavior in code similar to what the reference previously recommended.

Internal Changes

These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.

• Update to LLVM 23

astral-sh/uv (uv)

v0.13.0

Compare Source

Released on 2026-10-09.

uv 0.13.0 makes Python 3.15 the default stable Python version. We've also included several breaking changes to improve correctness, performance, and compatibility, described below.

We expect most users to be able to upgrade without making changes.

While not a breaking change, this release also updates the format of many of uv's cache entries to improve performance. uv may download or rebuild dependencies after upgrading, because some cached entries from earlier versions cannot be reused. Multiple versions of uv can still safely share the same cache directory.

There are no breaking changes to the configuration of the uv build backend. If your [build-system] table includes an upper bound on uv_build, update it to allow uv_build 0.13, e.g., uv_build>=0.13.0,<0.14.

Breaking changes

• Use Python 3.15 as the default stable version

  The default stable Python version has changed from 3.14 to 3.15. This affects Python downloads when no version is requested or pinned, e.g., when running uv python install.

  uv continues to use compatible Python installations that are already present. For example, uv venv can still use an installed Python 3.14. If no suitable interpreter is installed and automatic downloads are enabled, commands such as uv venv and uvx python can now download Python 3.15.

  You can opt out of this behavior by requesting Python 3.14 explicitly, e.g., uv venv --python 3.14. For projects, use uv python pin 3.14 to record the version in .python-version.

• Honor --require-hashes in included constraints files (#​22275)

  Previously, uv ignored --require-hashes in constraints files included with -c from a requirements file. Now, uv honors the directive and requires hashes for all requirements in the installation. Installs that previously succeeded can now fail if a requirement is missing a hash.

  You cannot opt out while the directive is present. Add the missing hashes to your requirements, or remove the --require-hashes directive from the included constraints file if hash checking is not intended.

• Prefer native Python on Windows ARM64 (#​22100)

  Previously, ARM64 builds of uv preferred emulated x86_64 Python installations because native wheel support was limited. Now, uv prefers native ARM64 (aarch64) interpreters across Python versions.

  This follows similar changes in CPython, the official Windows Python install manager, and GitHub's actions/setup-python.

  When a native interpreter is unavailable, uv continues to fall back to x86_64, then 32-bit x86.

  You can opt out of this behavior by setting UV_PYTHON_ARCH=x86_64 or requesting an explicit architecture, e.g., cpython-3.14-windows-x86_64. If you are using setup-uv, you can set python-arch: x86_64 instead.

• Reject editable requirements in included constraints files (#​22282)

  Previously, uv silently ignored editable (-e) requirements in constraints files included with -c from a requirements file. Now, uv rejects these requirements with an error, matching pip's behavior.

  You cannot opt out of this behavior. Move editable requirements to a requirements file passed with -r, or pass them directly with --editable, instead of including them in a constraints file.

• Omit the distutils startup patch on Python 3.10 and later (#​22096)

  Previously, uv installed _virtualenv.py and _virtualenv.pth into every new virtual environment to prevent distutils configuration from changing installation paths. Now, like virtualenv 21.6.0, uv omits these files on Python 3.10 and later, which already ignore the affected configuration keys. This reduces Python startup overhead. Python 3.9 and earlier retain the patch.

  You cannot opt out of this behavior. Existing virtual environments are not modified automatically. Recreate an environment with Python 3.10 or later to remove the patch.

  This stabilizes the no-distutils-patch preview feature.

• Treat requirement-file option values as single paths (#​22290)

  Previously, uv split values passed to --constraint, --override, --exclude, and --build-constraint on spaces, even when quoted. Now, each value is treated as a single path, allowing file paths containing spaces.

  You cannot opt out of this behavior. Repeat the option to provide multiple files. For example, replace -c "a.txt b.txt" with -c a.txt -c b.txt.

  Space-separated lists in UV_CONSTRAINT, UV_OVERRIDE, UV_EXCLUDE, and UV_BUILD_CONSTRAINT remain supported.

• Use tar-codec for tar archives by default (#​22094)

  Previously, uv used astral-tokio-tar to extract tar archives, build source distributions with uv_build, and read their metadata for uv publish. Now, uv uses tar-codec, which applies stricter validation when reading archives.

  uv may now reject archives containing hard links or unsupported tar extensions that previous versions accepted. Source distributions created by uv_build can also have different archive bytes and hashes.

  You can opt out of this behavior by setting UV_LEGACY_TAR_BACKEND=1.

  This stabilizes the tar-codec preview feature.

• Reject uv build --clear output directories that contain a build source
  (#​22276)

  Previously, uv build --clear could delete a project or input source distribution when the
  output directory contained the source. Now, uv rejects these output directories, including
  equivalent paths reached through symlinks, before clearing any build output.

  Select an output directory that does not contain any build sources, or omit --clear.

Python

• Add CPython 3.15.0 (#​22400)

Preview features

• Require hashes for build dependencies, including transitive dependencies, with --require-build-hashes (#​21411)

Performance

• Speed up revalidation of cached HTTP responses by avoiding rewrites of unchanged payloads (#​22130)
• Reduce allocations when reading cached HTTP responses (#​22136)
• Reduce cache storage for HTTP policies and package records (#​22135, #​22133)
• Reduce allocations for cached source distribution revisions (#​22131)

Bug fixes

• Fix incorrect dependency resolution when reusing source metadata with different build settings (#​22404)
• Avoid overlong wheel cache lock filenames on Windows (#​22134)

v0.12.24

Compare Source

Release Notes

Released on 2026-10-08.

Enhancements

• Remove orphaned temporary build environments with uv cache prune (#​22171)
• Accept PEP 508 marker operators directly before grouped expressions (#​22309)
• Reject malformed requirements-file options instead of partially parsing or ignoring them (#​22317)
• Show underlying filesystem and registry errors when managed Python uninstallation fails (#​22362)
• Identify the invalid source URL in Python mirror errors (#​22364)

Preview features

• Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#​22292)

Configuration

• Support custom installation mirrors for GraalPy (#​22269)
• Support custom installation mirrors for Pyodide (#​22271)
• Allow UV_NO_CACHE=false to override no-cache = true in configuration (#​22324)
• Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#​22144)

Performance

• Speed up later commands after creating an environment by warming its interpreter cache (#​21304)
• Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#​22246)
• Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#​22203)
• Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support (#​22242)
• Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (#​22144)
• Reduce Python download error formatting code size by sharing its formatter (#​22141)

Bug fixes

• Verify supplied hashes even when hash presence is disabled with --no-require-hashes or require-hashes = false (#​22369)
• Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (#​22360)
• Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (#​22237)
• Exclude optional dependencies from exports when their extras are activated only in incompatible environments (#​22234)
• Give explicit uv publish --trusted-publishing values precedence over configuration (#​22279)
• Allow UV_OFFLINE=false to override offline = true in configuration (#​22283)
• Allow UV_SYSTEM_CERTS=false to override system-certs = true in configuration (#​22291)
• Allow uv auth login over IPv6 loopback addresses (#​22306)
• Resolve GitHub dependencies whose Git references contain # or % characters (#​22281)
• Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (#​22322)
• Preserve JSON output from uv version and uv self version with a single --quiet flag (#​22280)
• Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (#​22284)
• Restore wheel incompatibility hints when WHEEL metadata contains multiple expanded Tag: rows (#​22235)
• Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (#​22302)
• Prevent workspace-cache assertion failures after modifying a project at the workspace root (#​22236)
• Hide the ignored --keyring-provider option from uv auth help (#​19520)
• Report HTTP client setup failures directly when resolving unnamed uv tool requirements (#​22320)

Documentation

• Update Docker and AWS Lambda examples to cache dependency layers using frozen lockfiles without project manifests (#​22172)
• Fix stale links and descriptions in Rust crate documentation (#​22311, #​22361)
• Fix a typo in the required-environments documentation (#​22238)

Install uv 0.12.24

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.ps1 | iex"

Download uv 0.12.24

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.12.23

Compare Source

Release Notes

Released on 2026-10-03.

Python

• Add CPython 3.15.0rc3 (#​22164)

Preview features

• Sync from uv.lock without a workspace manifest using uv sync --frozen with frozen-lockfile (#​22018)
• Export from uv.lock without a workspace manifest using uv export --frozen with frozen-lockfile (#​22007)
• Inspect dependency trees from uv.lock without a workspace manifest using uv tree --frozen with frozen-lockfile (#​22016)
• Inspect workspace metadata and optionally sync its environment from uv.lock without a workspace manifest using uv workspace metadata --frozen with frozen-lockfile (#​22017, #​22018)

Bug fixes

• Reject alternate sources for workspace members across conflicting dependency selections, avoiding lockfiles that cannot be installed (#​22153)
• Allow x86-64 Python interpreters running under emulation on Windows ARM64 to install compatible win_amd64 wheels instead of building from source (#​22099)

Install uv 0.12.23

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.23/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.23/uv-installer.ps1 | iex"

Download uv 0.12.23

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.12.22

Compare Source

Release Notes

Released on 2026-10-01.

Python

• Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (#​22147)

Enhancements

• Accept uppercase release suffixes in wheel platform tags (#​22113)
• Record workspace-member default groups in lockfiles (#​22010, #​22103)
• Record workspace-member dependency-group Python requirements in lockfiles (#​22044, #​22103)
• Record default groups for non-project workspace roots in lockfiles (#​22104)
• Record dependency-group Python requirements for non-project workspace roots in lockfiles (#​22104)
• Format URLs and paths consistently in CLI messages (#​21937)
• Hide the unsupported --offline option from uv publish help (#​22124)

Preview features

• Honor --no-default-groups in uv audit (#​22090)
• Report a clear error when uv audit or uv tool audit runs offline and hide the unsupported option from help (#​22114)

Configuration

• Add UV_PYTHON_ARCH to select an interpreter architecture independently of its Python version (#​22098)

Performance

❗ Important

✂ PR body was truncated to here.