Bump version to 0.7.12 (#13892)

Author: zanieb

CHANGELOG.md

@@ -3,6 +3,33 @@
 <!-- prettier-ignore-start -->
 
 
+## 0.7.12
+
+### Enhancements
+
+- Add `uv python pin --rm` to remove `.python-version` pins ([#13860](https://github.com/astral-sh/uv/pull/13860))
+- Don't hint at versions removed by `excluded-newer` ([#13884](https://github.com/astral-sh/uv/pull/13884))
+- Add hint to use `tool.uv.environments` on resolution error ([#13455](https://github.com/astral-sh/uv/pull/13455))
+- Add hint to use `tool.uv.required-environments` on resolution error ([#13575](https://github.com/astral-sh/uv/pull/13575))
+
+- Improve `python pin` error messages ([#13862](https://github.com/astral-sh/uv/pull/13862))
+
+### Bug fixes
+
+- Lock environments during `uv sync`, `uv add` and `uv remove` to prevent race conditions ([#13869](https://github.com/astral-sh/uv/pull/13869))
+- Add `--no-editable` to `uv export` for `pylock.toml` ([#13852](https://github.com/astral-sh/uv/pull/13852))
+
+### Documentation
+
+- List `.gitignore` in project init files ([#13855](https://github.com/astral-sh/uv/pull/13855))
+- Move the pip interface documentation into the concepts section ([#13841](https://github.com/astral-sh/uv/pull/13841))
+- Remove the configuration section in favor of concepts / reference ([#13842](https://github.com/astral-sh/uv/pull/13842))
+- Update Git and GitHub Actions docs to mention `gh auth login` ([#13850](https://github.com/astral-sh/uv/pull/13850))
+
+### Preview
+
+- Fix directory glob traversal fallback preventing exclusion of all files ([#13882](https://github.com/astral-sh/uv/pull/13882))
+
 ## 0.7.11
 
 ### Python
@@ -284,11 +311,11 @@ This release contains various changes that improve correctness and user experien
 ### Breaking changes
 
 - **Update `uv version` to display and update project versions ([#12349](https://github.com/astral-sh/uv/pull/12349))**
-
+  
   Previously, `uv version` displayed uv's version. Now, `uv version` will display or update the project's version. This interface was [heavily requested](https://github.com/astral-sh/uv/issues/6298) and, after much consideration, we decided that transitioning the top-level command was the best option.
-
+  
   Here's a brief example:
-
+  
   ```console
   $ uv init example
   Initialized project `example` at `./example`
@@ -300,72 +327,72 @@ This release contains various changes that improve correctness and user experien
   $ uv version --short
   1.0.0
   ```
-
+  
   If used outside of a project, uv will fallback to showing its own version still:
-
+  
   ```console
   $ uv version
   warning: failed to read project: No `pyproject.toml` found in current directory or any parent directory
     running `uv self version` for compatibility with old `uv version` command.
     this fallback will be removed soon, pass `--preview` to make this an error.
-
+  
   uv 0.7.0 (4433f41c9 2025-04-29)
   ```
-
+  
   As described in the warning, `--preview` can be used to error instead:
-
+  
   ```console
   $ uv version --preview
   error: No `pyproject.toml` found in current directory or any parent directory
   ```
-
+  
   The previous functionality of `uv version` was moved to `uv self version`.
 - **Avoid fallback to subsequent indexes on authentication failure ([#12805](https://github.com/astral-sh/uv/pull/12805))**
-
+  
   When using the `first-index` strategy (the default), uv will stop searching indexes for a package once it is found on a single index. Previously, uv considered a package as "missing" from an index during authentication failures, such as an HTTP 401 or HTTP 403 (normally, missing packages are represented by an HTTP 404). This behavior was motivated by unusual responses from some package indexes, but reduces the safety of uv's index strategy when authentication fails. Now, uv will consider an authentication failure as a stop-point when searching for a package across indexes. The `index.ignore-error-codes` option can be used to recover the existing behavior, e.g.:
-
+  
   ```toml
   [[tool.uv.index]]
   name = "pytorch"
   url = "https://download.pytorch.org/whl/cpu"
   ignore-error-codes = [401, 403]
   ```
-
+  
   Since PyTorch's indexes always return a HTTP 403 for missing packages, uv special-cases indexes on the `pytorch.org` domain to ignore that error code by default.
 - **Require the command in `uvx <name>` to be available in the Python environment ([#11603](https://github.com/astral-sh/uv/pull/11603))**
-
+  
   Previously, `uvx` would attempt to execute a command even if it was not provided by a Python package. For example, if we presume `foo` is an empty Python package which provides no command, `uvx foo` would invoke the `foo` command on the `PATH` (if present). Now, uv will error early if the `foo` executable is not provided by the requested Python package. This check is not enforced when `--from` is used, so patterns like `uvx --from foo bash -c "..."` are still valid. uv also still allows `uvx foo` where the `foo` executable is provided by a dependency of `foo` instead of `foo` itself, as this is fairly common for packages which depend on a dedicated package for their command-line interface.
 - **Use index URL instead of package URL for keyring credential lookups ([#12651](https://github.com/astral-sh/uv/pull/12651))**
-
+  
   When determining credentials for querying a package URL, uv previously sent the full URL to the `keyring` command. However, some keyring plugins expect to receive the *index URL* (which is usually a parent of the package URL). Now, uv requests credentials for the index URL instead. This behavior matches `pip`.
 - **Remove `--version` from subcommands ([#13108](https://github.com/astral-sh/uv/pull/13108))**
-
+  
   Previously, uv allowed the `--version` flag on arbitrary subcommands, e.g., `uv run --version`. However, the `--version` flag is useful for other operations since uv is a package manager. Consequently, we've removed the `--version` flag from subcommands — it is only available as `uv --version`.
 - **Omit Python 3.7 downloads from managed versions ([#13022](https://github.com/astral-sh/uv/pull/13022))**
-
+  
   Python 3.7 is EOL and not formally supported by uv; however, Python 3.7 was previously available for download on a subset of platforms.
 - **Reject non-PEP 751 TOML files in install, compile, and export commands ([#13120](https://github.com/astral-sh/uv/pull/13120), [#13119](https://github.com/astral-sh/uv/pull/13119))**
-
+  
   Previously, uv treated arbitrary `.toml` files passed to commands (e.g., `uv pip install -r foo.toml` or `uv pip compile -o foo.toml`) as `requirements.txt`-formatted files. Now, uv will error instead. If using PEP 751 lockfiles, use the standardized format for custom names instead, e.g., `pylock.foo.toml`.
 - **Ignore arbitrary Python requests in version files ([#12909](https://github.com/astral-sh/uv/pull/12909))**
-
+  
   uv allows arbitrary strings to be used for Python version requests, in which they are treated as an executable name to search for in the `PATH`. However, using this form of request in `.python-version` files is non-standard and conflicts with `pyenv-virtualenv` which writes environment names to `.python-version` files. In this release, uv will now ignore requests that are arbitrary strings when found in `.python-version` files.
 - **Error on unknown dependency object specifiers ([12811](https://github.com/astral-sh/uv/pull/12811))**
-
+  
   The `[dependency-groups]` entries can include "object specifiers", e.g. `set-phasers-to = ...` in:
-
+  
   ```toml
   [dependency-groups]
   foo = ["pyparsing"]
   bar = [{set-phasers-to = "stun"}]
   ```
-
+  
   However, the only current spec-compliant object specifier is `include-group`. Previously, uv would ignore unknown object specifiers. Now, uv will error.
 - **Make `--frozen` and `--no-sources` conflicting options ([#12671](https://github.com/astral-sh/uv/pull/12671))**
-
+  
   Using `--no-sources` always requires a new resolution and `--frozen` will always fail when used with it. Now, this conflict is encoded in the CLI options for clarity.
 - **Treat empty `UV_PYTHON_INSTALL_DIR` and `UV_TOOL_DIR` as unset ([#12907](https://github.com/astral-sh/uv/pull/12907), [#12905](https://github.com/astral-sh/uv/pull/12905))**
-
+  
   Previously, these variables were treated as set to the current working directory when set to an empty string. Now, uv will ignore these variables when empty. This matches uv's behavior for other environment variables which configure directories.
 
 ### Enhancements

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "uv-build"
-version = "0.7.11"
+version = "0.7.12"
 edition.workspace = true
 rust-version.workspace = true
 homepage.workspace = true

crates/uv-build/Cargo.toml

@@ -1,6 +1,6 @@
 [project]
 name = "uv-build"
-version = "0.7.11"
+version = "0.7.12"
 description = "The uv build backend"
 authors = [{ name = "Astral Software Inc.", email = "[email protected]" }]
 requires-python = ">=3.8"

crates/uv-build/pyproject.toml

@@ -1,6 +1,6 @@
 [package]
 name = "uv-version"
-version = "0.7.11"
+version = "0.7.12"
 edition = { workspace = true }
 rust-version = { workspace = true }
 homepage = { workspace = true }

crates/uv-version/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "uv"
-version = "0.7.11"
+version = "0.7.12"
 edition = { workspace = true }
 rust-version = { workspace = true }
 homepage = { workspace = true }

crates/uv/Cargo.toml

@@ -19,7 +19,7 @@ existing project, add it to the `[build-system]` section in your `pyproject.toml
 
 ```toml
 [build-system]
-requires = ["uv_build>=0.7.11,<0.8.0"]
+requires = ["uv_build>=0.7.12,<0.8.0"]
 build-backend = "uv_build"
 ```
 

docs/concepts/build-backend.md

@@ -25,7 +25,7 @@ uv provides a standalone installer to download and install uv:
     Request a specific version by including it in the URL:
 
     ```console
-    $ curl -LsSf https://astral.sh/uv/0.7.11/install.sh | sh
+    $ curl -LsSf https://astral.sh/uv/0.7.12/install.sh | sh
     ```
 
 === "Windows"
@@ -41,7 +41,7 @@ uv provides a standalone installer to download and install uv:
     Request a specific version by including it in the URL:
 
     ```pwsh-session
-    PS> powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/0.7.11/install.ps1 | iex"
+    PS> powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/0.7.12/install.ps1 | iex"
     ```
 
 !!! tip

docs/getting-started/installation.md

@@ -92,7 +92,7 @@ the second stage, we'll copy this directory over to the final image, omitting th
 other unnecessary files.
 
 ```dockerfile title="Dockerfile"
-FROM ghcr.io/astral-sh/uv:0.7.11 AS uv
+FROM ghcr.io/astral-sh/uv:0.7.12 AS uv
 
 # First, bundle the dependencies into the task root.
 FROM public.ecr.aws/lambda/python:3.13 AS builder
@@ -334,7 +334,7 @@ And confirm that opening http://127.0.0.1:8000/ in a web browser displays, "Hell
 Finally, we'll update the Dockerfile to include the local library in the deployment package:
 
 ```dockerfile title="Dockerfile"
-FROM ghcr.io/astral-sh/uv:0.7.11 AS uv
+FROM ghcr.io/astral-sh/uv:0.7.12 AS uv
 
 # First, bundle the dependencies into the task root.
 FROM public.ecr.aws/lambda/python:3.13 AS builder

docs/guides/integration/aws-lambda.md

@@ -31,7 +31,7 @@ $ docker run --rm -it ghcr.io/astral-sh/uv:debian uv --help
 The following distroless images are available:
 
 - `ghcr.io/astral-sh/uv:latest`
-- `ghcr.io/astral-sh/uv:{major}.{minor}.{patch}`, e.g., `ghcr.io/astral-sh/uv:0.7.11`
+- `ghcr.io/astral-sh/uv:{major}.{minor}.{patch}`, e.g., `ghcr.io/astral-sh/uv:0.7.12`
 - `ghcr.io/astral-sh/uv:{major}.{minor}`, e.g., `ghcr.io/astral-sh/uv:0.7` (the latest patch
   version)
 
@@ -75,7 +75,7 @@ And the following derived images are available:
 
 As with the distroless image, each derived image is published with uv version tags as
 `ghcr.io/astral-sh/uv:{major}.{minor}.{patch}-{base}` and
-`ghcr.io/astral-sh/uv:{major}.{minor}-{base}`, e.g., `ghcr.io/astral-sh/uv:0.7.11-alpine`.
+`ghcr.io/astral-sh/uv:{major}.{minor}-{base}`, e.g., `ghcr.io/astral-sh/uv:0.7.12-alpine`.
 
 For more details, see the [GitHub Container](https://github.com/astral-sh/uv/pkgs/container/uv)
 page.
@@ -113,7 +113,7 @@ Note this requires `curl` to be available.
 In either case, it is best practice to pin to a specific uv version, e.g., with:
 
 ```dockerfile
-COPY --from=ghcr.io/astral-sh/uv:0.7.11 /uv /uvx /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.7.12 /uv /uvx /bin/
 ```
 
 !!! tip
@@ -131,7 +131,7 @@ COPY --from=ghcr.io/astral-sh/uv:0.7.11 /uv /uvx /bin/
 Or, with the installer:
 
 ```dockerfile
-ADD https://astral.sh/uv/0.7.11/install.sh /uv-installer.sh
+ADD https://astral.sh/uv/0.7.12/install.sh /uv-installer.sh
 ```
 
 ### Installing a project
@@ -557,5 +557,5 @@ Verified OK
 !!! tip
 
     These examples use `latest`, but best practice is to verify the attestation for a specific
-    version tag, e.g., `ghcr.io/astral-sh/uv:0.7.11`, or (even better) the specific image digest,
+    version tag, e.g., `ghcr.io/astral-sh/uv:0.7.12`, or (even better) the specific image digest,
     such as `ghcr.io/astral-sh/uv:0.5.27@sha256:5adf09a5a526f380237408032a9308000d14d5947eafa687ad6c6a2476787b4f`.