uv 0.12.17

uv 0.12.17 was released on September 18, 2026 as the latest patch release in the 0.12 line of the fast Python package and project manager from Astral. This update carries forward the reliability work that began earlier in the cycle, focusing on lockfile handling and dependency installation safety.

Overview

Astral shipped uv 0.12.16 and 0.12.17 in quick succession during September 2026. The headline theme is hardening: making failure modes clearer and verifying the artifacts uv installs from the index.

New Features and Fixes

• Clearer lockfile errors: uv now rejects unsupported Git archive paths in lockfiles with a descriptive error instead of panicking during frozen exports. Projects that export frozen dependency sets no longer crash on unusual Git source forms.
• Index hash verification: continuing the work from 0.12.16, downloaded wheels and source distributions are verified against hashes supplied by the package index, catching mismatches before installation completes.

Why It Matters

Frozen exports and locked reproducibility are central to uv usage in CI pipelines and container builds. Replacing a panic with a clear message turns an opaque build failure into an actionable one, while hash verification strengthens the supply chain.

uv 0.12.17 is available through the standard installer, common package managers, and the 0.12 release tag. Upgrading is recommended for teams that rely on frozen lockfile exports.