uv 0.12.13 verifies hashes on PEP 658 metadata sidecars and skips full wheel downloads during resolution

GitHub·medium signalXBlueskyLinkedInCopy link

astral-sh/uv 0.12.13 (2026-09-10) now verifies hashes when downloading PEP 658 metadata sidecars, which closes a gap where resolution trusted metadata that no hash covered. It also avoids downloading full wheels during resolution by reusing hashes from direct-URL fragments when metadata is available separately. The release adds GraalPy 3.13.0, and it edits Windows launcher resources in memory to support Nano Server and cut antivirus contention.