Lataa uv 0.13.2

Released on 2026-10-19.
Enhancements
- Report all installed packages in uv workspace metadata, including packages outside the selected resolution (#22395)
- Include supported environment restrictions when exporting pylock.toml (#22596)
- Retry dropped GET and HEAD requests when fetching package and index data (#22672)
- Preserve encoding declarations in wheel data scripts that require shell launchers (#22526)
- Show causes and hints when uv python find --script cannot discover an interpreter, including with -q (#22549)
- Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh (#22538, #22572)
- Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's [build-system].requires validation (#22577)
Python
- Add PyPy 3.11.17 and 3.12.15 (#22578)
Preview features
- Fetch and parse PEP 825 index-level variant metadata with wheel-variants (#22509, #22511)
Performance
- Avoid exponential work when simplifying, traversing, and exporting complex dependency markers (#22608, #22615, #22651, #22674)
- Reduce the time and memory used to parse and store complex dependency markers (#22675, #22676, #22681)
- Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups (#22565, #22625)
- Speed up project discovery in large workspaces by caching member names (#22635)
- Reduce uv's binary size and speed up CycloneDX exports (#22431)
- Reduce uv-build binary size, including Linux x86_64 wheels (#22539, #22573)
- Reduce allocations when parsing TOML (#22679)
Bug fixes
- Respect --exclude-newer when a newer wheel for the selected source distribution is already cached (#22685)
- Prevent URL credentials from leaking through diagnostics or persisted metadata (#22600, #22601, #22617, #22622, #22646)
- Keep separate cache entries for signed --find-links URLs that differ only in sensitive query values (#22630)
- Honor PEP 751 environment restrictions when installing or syncing from pylock.toml (#22594)
- Use configured credentials before prompting during uv publish, and avoid prompting when no upload occurs (#22593)
- Match recursive build globs against complete file paths and ignore invalid license symlinks (#22581, #22583)
- Return an error for invalid uv pip compile --python-version values instead of panicking (#22727)
- Reject invalid pylock.toml output filenames before resolution instead of panicking (#22725)
- Avoid panicking during repeated resolution conflicts involving fixed-priority packages (#22589)
- Create version aliases correctly when installing managed Python into a relative directory (#22547)
- Show incompatibilities from failing uv pip check invocations with -q (#22544)
- Treat logically equivalent dependency markers as equal regardless of construction order (#22680)
Rust API
- Require the opt-in unsafe-url feature to use raw url::Url APIs in uv-pep508 (#22623)
Documentation
- Clarify credential lookup, environment synchronization, managed Python, and integration guidance (#22542)
Other changes
- Use stable sh.astral.* signing identifiers for macOS binaries (#22648)