Tools
uv 0.12.11 now verifies source archives against uv.lock hashes before running their build backends
Released 2026-09-08, uv 0.12.11 fixes a real supply-chain gap: source archives were previously read for metadata and had their build backends executed before their recorded uv.lock hash was checked, meaning arbitrary code from a tampered sdist ran before verification. It also verifies supplied hashes for registry requirements pinned with `===` under both --verify-hashes and --require-hashes. The release adds warnings for empty pylock.toml artifact hash tables, which a future uv will reject outright, plus five install-path speedups from eliminating per-file temporary directories.
Source
↳ Follow the thread