uv 0.13.0

Release Date: October 9, 2026

Astral released uv 0.13.0 on October 9, 2026, the latest version of the Python package and project manager that has become the default tooling choice for a large share of new Python projects. The release makes Python 3.15 the default stable interpreter, switches the tar backend, and tightens several validation rules that previously passed silently. The maintainers describe the upgrade as low risk for most users: "We expect most users to be able to upgrade without making changes."

What Changed

The headline change is the default Python version. uv now treats Python 3.15 as the default stable release, up from 3.14. When no version is requested or pinned, commands such as uv python install, uv venv, and uvx python can now download Python 3.15 automatically if no suitable interpreter is already installed. Compatible interpreters that are already present continue to be used, so an existing 3.14 environment still works. Teams that want to stay on 3.14 can request it explicitly with uv venv --python 3.14, or record it in the project with uv python pin 3.14.

CPython 3.15.0 is now available for install through uv as part of the same release.

A second, quieter change affects caching. uv updated the format of many cache entries to improve performance. The practical consequence, stated plainly in the release notes, is that uv may download or rebuild dependencies after the upgrade because some cached entries from earlier versions cannot be reused. Multiple uv versions can still share the same cache directory safely.

Why It Matters

Two of the breaking changes replace silent behavior with loud behavior. That is usually the right trade for a package manager, but it can turn a previously green install into a failing one without any change to your code.

First, --require-hashes inside a constraints file passed with -c is now honored. Previously, uv ignored the directive in included constraints files and installed anyway. Installs that succeeded before can now fail if a requirement is missing a hash. There is no opt-out while the directive is present: add the missing hashes, or remove the directive if hash checking was never intended.

Second, editable requirements (-e) inside included constraints files are now rejected with an error, matching pip's documented behavior. Previously they were ignored without a warning. The fix is to move those entries into a requirements file passed with -r, or to pass them directly with --editable.

Breaking Changes in Detail

Python 3.15 as the default stable version. Affects any command that resolves or downloads an interpreter without an explicit version.
Hash checking in included constraints files. --require-hashes in a constraints file is now enforced, so incomplete hash sets will fail installs.
Native Python on Windows ARM64. uv now prefers native ARM64 interpreters instead of emulated x86_64 builds, following similar moves in CPython, the Windows Python install manager, and GitHub's setup-python action. It still falls back to x86_64 and then 32-bit x86 when no native build is available. Opt out with UV_PYTHON_ARCH=x86_64.
Editable requirements rejected in included constraints files. No opt-out.
distutils startup patch omitted on Python 3.10 and newer. uv no longer installs _virtualenv.py and _virtualenv.pth into new virtual environments on modern Python, which reduces interpreter startup overhead. Existing environments are not modified automatically; recreate one on Python 3.10 or later to drop the patch. This stabilizes the no-distutils-patch preview feature.
Requirement-file option values treated as single paths. Values passed to --constraint, --override, --exclude, and --build-constraint are no longer split on spaces, which fixes paths that contain spaces but breaks the old trick of packing several files into one quoted argument. Repeat the option instead: -c a.txt -c b.txt. The space-separated environment variables (UV_CONSTRAINT, UV_OVERRIDE, UV_EXCLUDE, UV_BUILD_CONSTRAINT) still work as before.
tar-codec as the default tar backend. uv now reads tar archives with tar-codec instead of astral-tokio-tar, applying stricter validation. Archives containing hard links or unsupported extensions may now be rejected, and source distributions built by uv_build can produce different archive bytes and hashes. Set UV_LEGACY_TAR_BACKEND=1 to revert. This stabilizes the tar-codec preview feature.
uv build --clear refuses dangerous output directories. If the output directory contains a project or an input source distribution, including paths reached through symlinks, uv now rejects the directory before clearing anything. Previously it could delete the source.

Performance and Smaller Fixes

Most of the performance work in 0.13.0 lands in the HTTP cache: uv avoids rewriting unchanged cached payloads during revalidation, reduces allocations when reading cached HTTP responses, shrinks cache storage for HTTP policies and package records, and cuts allocations for cached source distribution revisions. One bug fix stops overlong wheel cache lock filenames on Windows.

A new preview feature, --require-build-hashes, extends hash requirements to build dependencies including transitive ones.

How to Upgrade

Upgrade through the installer you already use, whether that is the standalone shell installer, pipx, Homebrew, or the Windows installer script. One detail worth checking first: there are no breaking changes to the build backend's configuration, but if your [build-system] table pins an upper bound on uv_build, widen it to allow 0.13, for example uv_build>=0.13.0,<0.14. Without that change, builds can fail on the version constraint rather than on the code.

What's Next