uv 0.12.9

I upgraded three Python projects to uv 0.12.9 today, and the lock-mode flags alone were worth the install. Released September 1, 2026, this patch is small but practical: one new CPython build, two CLI conveniences, and a handful of install-speed and security fixes.

The Stuff You Will Actually Use

The headline for me is the new one-shot lock overrides. If your CI sets UV_LOCKED or UV_FROZEN globally, you can now pass --no-locked or --no-frozen on a single invocation to disable that policy just for that command. That is handy for ad-hoc experiments without editing CI yaml. uv also reports the exact lock-mode flag that is active in warnings and errors, so the messages now tell you which configuration key is controlling the behavior.

Performance Pass

Cold wheel installs got a real speedup. The installer now extracts each streaming ZIP archive in a single blocking task and reuses buffers across files, which cuts the per-wheel overhead on first install. It also stops concurrent uv processes from redundantly extracting the same local or source-built wheel.

Security and Correctness Fixes

• Memory safety: async_http_range_reader bumps to 0.11.1, closing a potential memory-safety issue when reading metadata ranges from untrusted wheels.
• Header leaks: sensitive headers are removed when redirects cross authentication realms, including same-host redirects that change URL schemes.
• Secrets in logs: signed URLs are redacted from retry diagnostics, including nested request errors.
• Flag precedence: --locked, --frozen, --check, and --check-exists now override conflicting UV_LOCKED and UV_FROZEN environment values.

Verdict

0.12.9 is a low-risk upgrade. If you use uv in CI or install wheels from external indexes, apply it. The lock-mode precedence fix and the redaction changes are the two that might silently improve your workflow without you noticing.