astral-sh/uv 0.10.8

on GitHub

Release Notes

Released on 2026-03-03.

Python

• Add CPython 3.10.20
• Add CPython 3.11.15
• Add CPython 3.12.13

Enhancements

• Add Docker images based on Docker Hardened Images (#18247)
• Add resolver hint when --exclude-newer filters out all versions of a package (#18217)
• Configure a real retry minimum delay of 1s (#18201)
• Expand uv_build direct build compatibility (#17902)
• Fetch CPython from an Astral mirror by default (#18207)
• Download uv releases from an Astral mirror in installers by default (#18191)
• Add SBOM attestations to Docker images (#18252)
• Improve hint for installing meson-python when missing as build backend (#15826)

Configuration

• Add UV_INIT_BARE environment variable for uv init (#18210)

Bug fixes

• Prevent uv tool upgrade from installing excluded dependencies (#18022)
• Promote authentication policy when saving tool receipts (#18246)
• Respect exclusions in scripts (#18269)
• Retain default-branch Git SHAs in pylock.toml files (#18227)
• Skip installed Python check for URL dependencies (#18211)
• Respect constraints during --upgrade (#18226)
• Fix uv tree orphaned roots and premature deduplication (#17212)

Documentation

• Mention cooldown and tweak inline script metadata in dependency bots documentation (#18230)
• Move cache prune in GitLab to after_script (#18206)

Install uv 0.10.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.10.8/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.10.8/uv-installer.ps1 | iex"

Download uv 0.10.8

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>