July 28, 2026

Safer update, messier feelings

Uv 0.12.0

Python fans cheer, panic, and beg for easier upgrades in uv’s big shake-up

TLDR: uv 0.12.0 makes the Python tool stricter and safer by default, while also changing how new projects are set up. Fans praised it loudly, but the comments quickly filled with demands for easier upgrades, missing features, and worried questions about edge-case safety.

The new uv 0.12.0 release is one of those updates that arrives with the classic developer warning label: better, safer, more correct... and possibly workflow-breaking. The team says most people should be fine, but the comments instantly turned the announcement into a mini soap opera. Maintainer woodruffw set the tone with a calm “first breaking release since March” and an open invitation for questions, which the community happily interpreted as permission to bring all their baggage.

And bring it they did. One camp was pure hype, with analognoise dropping the wildly unfiltered endorsement, “uv fucks,” basically summing up the fan club’s mood in two words. Another camp immediately swerved into practical frustration: when will it install gdal? asked drzhouq, turning a release about safety and packaging defaults into a reminder that users mostly care whether the thing does the annoying task they need today. Then came the long-running complaint from XorNot, who wants a simple “upgrade everything” button and called the current experience obtuse. That’s the real drama here: the software is getting stricter and safer, while users are still begging for fewer mysteries and fewer hoops.

There was even a wonderfully niche panic about “worm safety” and unpinned code pulled straight from live repositories, proving once again that every release thread contains at least one comment that sounds like a cybersecurity thriller. So yes, uv got stricter about risky package files and now creates projects in a more polished, ready-to-share layout by default. But the real headline is the comment section: horny praise, feature begging, upgrade confusion, and one extremely specific security anxiety.

Key Points

  • uv 0.12.0 groups changes aimed at correctness, safety, and standards compatibility, with some marked as breaking though most users are expected to upgrade without changes.
  • `uv init` now creates packaged projects by default, using `uv_build`, a `src/` layout, and a `[project.scripts]` entry; existing projects are unaffected and `--no-package` preserves the old layout.
  • uv now enforces stricter distribution format rules by rejecting legacy source distribution formats such as `.tar.bz2` and `.tar.xz`, while still allowing legacy `.zip` sdists for backward compatibility.
  • Wheels and ZIP archives may no longer use bzip2, LZMA, or XZ-compressed entries; only stored, DEFLATE, or zstd methods are accepted.
  • uv now blocks more wheel patterns that could overwrite Python interpreters during installation, including case-insensitive interpreter names and certain files placed in wheel data directories.

Hottest takes

"uv fucks" — analognoise
"When can uv install gdal?" — drzhouq
"It's still very obtuse" — XorNot
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.