uv 0.13.2 is out: highlights and upgrade guide

What's included in uv 0.13.2

Details from the official release page.

Enhancements

• Report all installed packages in uv workspace metadata, including packages outside the selected resolution (#22395)
• Include supported environment restrictions when exporting pylock.toml (#22596)
• Retry dropped GET and HEAD requests when fetching package and index data (#22672)
• Preserve encoding declarations in wheel data scripts that require shell launchers (#22526)
• Show causes and hints when uv python find --script cannot discover an interpreter, including with -q (#22549)
• Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh (#22538, #22572)
• Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's [build-system].requires validation (#22577)

Python

• Add PyPy 3.11.17 and 3.12.15 (#22578)

Preview features

• Fetch and parse PEP 825 index-level variant metadata with wheel-variants (#22509, #22511)

Performance

• Avoid exponential work when simplifying, traversing, and exporting complex dependency markers (#22608, #22615, #22651, #22674)
• Reduce the time and memory used to parse and store complex dependency markers (#22675, #22676, #22681)
• Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups (#22565, #22625)
• Speed up project discovery in large workspaces by caching member names (#22635)
• Reduce uv's binary size and speed up CycloneDX exports (#22431)
• Reduce uv-build binary size, including Linux x86_64 wheels (#22539, #22573)
• Reduce allocations when parsing TOML (#22679)

Bug fixes

• Respect --exclude-newer when a newer wheel for the selected source distribution is already cached (#22685)
• Prevent URL credentials from leaking through diagnostics or persisted metadata (#22600, #22601, #22617, #22622, #22646)
• Keep separate cache entries for signed --find-links URLs that differ only in sensitive query values (#22630)
• Honor PEP 751 environment restrictions when installing or syncing from pylock.toml (#22594)
• Use configured credentials before prompting during uv publish, and avoid prompting when no upload occurs (#22593)
• Match recursive build globs against complete file paths and ignore invalid license symlinks (#22581, #22583)
• Return an error for invalid uv pip compile --python-version values instead of panicking (#22727)
• Reject invalid pylock.toml output filenames before resolution instead of panicking (#22725)
• Avoid panicking during repeated resolution conflicts involving fixed-priority packages (#22589)
• Create version aliases correctly when installing managed Python into a relative directory (#22547)
• Show incompatibilities from failing uv pip check invocations with -q (#22544)
• Treat logically equivalent dependency markers as equal regardless of construction order (#22680)

Rust API

• Require the opt-in unsafe-url feature to use raw url::Url APIs in uv-pep508 (#22623)

Documentation

• Clarify credential lookup, environment synchronization, managed Python, and integration guidance (#22542)

Other changes

• Use stable sh.astral.* signing identifiers for macOS binaries (#22648)

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

You can also download the attestation from GitHub and verify against that directly: