chore(deps): update dependency uv to v0.11.15 [security] - #14
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency uv to v0.11.15 [security]#14renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/pypi-uv-vulnerability
branch
2 times, most recently
from
April 27, 2026 22:17
55a239b to
1dc99b5
Compare
renovate
Bot
force-pushed
the
renovate/pypi-uv-vulnerability
branch
from
May 18, 2026 10:29
1dc99b5 to
a8c9651
Compare
renovate
Bot
force-pushed
the
renovate/pypi-uv-vulnerability
branch
from
May 30, 2026 00:44
a8c9651 to
85a33d2
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/pypi-uv-vulnerability
branch
from
June 11, 2026 15:09
85a33d2 to
13abf15
Compare
renovate
Bot
force-pushed
the
renovate/pypi-uv-vulnerability
branch
from
July 9, 2026 06:16
13abf15 to
c7e6679
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/pypi-uv-vulnerability
branch
from
July 21, 2026 01:42
c7e6679 to
b171fa9
Compare
renovate
Bot
force-pushed
the
renovate/pypi-uv-vulnerability
branch
from
July 30, 2026 16:54
b171fa9 to
28599e3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.11.1→0.11.15uv vulnerable to arbitrary file deletion through RECORD entries
GHSA-pjjw-68hj-v9mw
More information
Details
Impact
Wheel RECORD entries can contain relative paths that traverse outside of the wheel’s installation prefix. In versions 0.11.5 and earlier of uv, these wheels were not rejected on installation and the RECORD was respected without validation on uninstall.
uv uses the RECORD to determine files to remove on uninstall. Consequently, a malicious or malformed wheel could induce deletion of arbitrary files outside of the wheel’s installation prefix on uninstall.
uv does not use the RECORD file to determine wheel file paths. Invalid RECORD entries cannot be used to create or modify files in arbitrary locations.
Standards-compliant Python packaging tooling does not produce RECORD files that exhibit this behavior; an attacker must manually manipulate the RECORD. A user must install and uninstall the malformed wheel to be affected. An attack must guess the depth of the installation prefix path in order to target system files.
Absolute paths in RECORD files are not allowed by the specification and, when present, uv always treats them as rooted in the wheel’s installation prefix. Absolute paths cannot be used to delete arbitrary files.
Only files can be deleted, attempts to delete a directory via an invalid RECORD entry will fail.
Patches
Versions 0.11.6 and newer of uv address the validation gap above, by removing invalid entries from RECORD files on wheel installation and ignoring RECORD paths that would escape the installation prefix on uninstall.
Workarounds
Users are advised to upgrade to 0.11.6 or newer to address this advisory.
Users should experience no breaking changes as a result of the patch above.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
uv is vulnerable to arbitrary file write through entry point names
GHSA-4gg8-gxpx-9rph
More information
Details
Impact
In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under
console_scriptsorgui_scripts), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory.A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's
PATH. This could shadow or overwrite an existing executable and potentially result in unexpected code execution under the wheel's control, even if the wheel's installation environment was not explicitly added toPATHby the user.In order to exploit this vulnerability, the attacker must induce their target into installing a malicious wheel.
Patches
uv 0.11.15 and newer address this vulnerability. Users are encouraged to upgrade to 0.11.15.
Workarounds
There is no workaround other than upgrading to uv 0.11.15.
Severity
Medium
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
astral-sh/uv (uv)
v0.11.15Compare Source
Release Notes
Released on 2026-05-18.
Security
Enhancements
Preview
Configuration
required-environmentsinuv pip compile(#19378)Performance
Version::only_release_trimmed(#19425)Bug fixes
[tool.uv.sources]credentials underuv sync --frozen(#19423)Documentation
Install uv 0.11.15
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-installer.ps1 | iex"Download uv 0.11.15
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.11.14Compare Source
Release Notes
Released on 2026-05-12.
Enhancements
top_level.txtentries in uninstall that are not valid Python identifiers (#19340)Bug fixes
.envfiles in parent process (#19343)uv treeshowing extra-conditional deps for packages required without extras (#19332)--no-build) during lock validation (#19366)Install uv 0.11.14
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-installer.ps1 | iex"Download uv 0.11.14
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.11.13Compare Source
Release Notes
Released on 2026-05-10.
Bug fixes
--require-hasheswhen installing frompylock.tomlfiles (#19334)Python
Install uv 0.11.13
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-installer.ps1 | iex"Download uv 0.11.13
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.11.12Compare Source
Release Notes
Released on 2026-05-08.
Python
Enhancements
--no-editablesupport touv pip install(#19306)Bug fixes
Respect
--no-devoverUV_DEV=1(#19313)Don't suggest non-existent
--no-frozenflag (#19290) (#19294)Documentation
Install uv 0.11.12
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-installer.ps1 | iex"Download uv 0.11.12
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.11.11Compare Source
Release Notes
Released on 2026-05-06.
Bug fixes
Install uv 0.11.11
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-installer.ps1 | iex"Download uv 0.11.11
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.11.10Compare Source
Release Notes
Released on 2026-05-05.
Bug fixes
Install uv 0.11.10
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-installer.ps1 | iex"Download uv 0.11.10
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.11.9Compare Source
Release Notes
Released on 2026-05-04.
Note due to a timeout publishing to crates.io, the GitHub portion of this release was published manually by a maintainer using the artifacts built in CI. Consequently, GitHub attestations will not be available. Additionally, this release will not be fully published to crates.io. There should be no other effects.
Python 3.14.5 release candidate
This release includes a special release candidate for the next Python 3.14 patch release. Python 3.14 included a new garbage collection implementation, which reduced pause times but caused significant unexpected memory pressure in production environments. In 3.14.5 and 3.15, the previous garbage collection implementation will be restored.
We would greatly appreciate if you tested the 3.14.5rc1 version included in this release. The stable version is expected to be released soon and any feedback on potential issues would be helpful to the Python development team.
For more context, see the announcement, issue, and pull request.
Issues with the new release can be reported in the uv or CPython issue trackers.
Python
libpythonto match LinuxEnhancements
Preview
uv auditadd reporting for adverse project statuses (#19128)Bug fixes
requires-pythonpins a version (#18700)LockedFile::dropon Wine (#19229)top_level.txtin.egg-info(#19114)