pkg.sopackage field notes

brew / 承認ゲート / 順位 26

uv を Homebrew でインストール

uv のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。

エージェント安全性

エージェント安全性の回答

uv manages Python environments, dependencies, tools, and package publishing workflows.

認証情報アクセス

Reads Python index credentials, environment variables, and project configuration.

リモート変更

Can install packages, resolve remote indexes, and run project commands.

公開/成果物リスク

Can build or publish Python packages when paired with packaging commands.

推奨コントロール

Gate publishing and secret-backed index access; scan project env files first.

エージェント利用ガイダンス

Allow lock/test operations; require approval for publish, credentialed index writes, and script execution using secrets.

インストール

追加のインストールコマンド

macOS

Homebrew確認済み · 100%
brew install uv

provider-native install command

概要

パッケージ概要

Extremely fast Python package installer and resolver, written in Rust

コマンドとエイリアス

  • uv
  • uvx

履歴

プロジェクトの歴史と使われ方

uv is Astral's Rust-written Python package and project manager. It began as a fast installer and resolver for pip and pip-tools workflows, then expanded into a unified interface for dependency resolution, virtual environments, project management, scripts, tools, and Python installation.

プロジェクトの歴史

Astral announced uv in February 2024 as the next tool in the same high-performance Python-tooling line as Ruff. The initial public framing was deliberately pragmatic: support common pip and pip-tools APIs under `uv pip`, provide a resolver, virtual environment creator, installer, sync command, and do so without requiring projects to rewrite their packaging workflow.

In August 2024 Astral announced a larger expansion of uv, describing it as moving beyond a pip alternative into an end-to-end solution for Python projects, command-line tools, single-file scripts, and Python itself. The official documentation later presented uv as a single tool replacing or overlapping pip, pip-tools, pipx, poetry, pyenv, twine, virtualenv, and related pieces of the Python packaging stack.

採用の歴史

uv's adoption path was shaped by compatibility and speed rather than by a new packaging format alone. Astral emphasized that the first release was production-ready for existing pip and pip-tools workflows and required little configuration for those users.

Package-manager adoption followed the same low-friction pattern. The official installation documentation lists standalone installers, PyPI installation, Homebrew, MacPorts, WinGet, Scoop, Docker images, and other distribution routes, making uv easy to place in developer laptops, CI images, and reproducible build environments.

使われ方

For package-nerd workflows, uv is commonly used as a faster `pip install`, `pip compile`, `pip sync`, `venv`, and `pipx`-style tool runner. In project mode, it centers dependency state around `pyproject.toml` and `uv.lock`, while retaining a `uv pip` interface for requirements-file and environment-oriented workflows.

The official docs call out a global cache, Cargo-style workspaces, cross-platform installation, and integrations for Docker, GitHub Actions, GitLab CI/CD, pre-commit, PyTorch, FastAPI, Bazel, and several private package registries. Those are the surfaces that made uv especially interesting to people who care about resolver behavior, lockfiles, build reproducibility, and CI runtime.

パッケージ好きにとっての重要性

uv matters in package-manager culture because it compressed several long-standing Python packaging pain points into one fast executable: resolution, installation, environment creation, lockfile generation, tool execution, and Python runtime management. Its significance is not just that it is fast, but that it made speed available through familiar pip-shaped entry points before asking users to adopt its fuller project model.

It also accelerated the Rust-based rewrite trend in Python infrastructure. Like Ruff for linting and formatting, uv made performance a central product argument and forced comparisons with older Python-native tools such as pip-tools, Poetry, PDM, pipx, and virtualenv.

タイムライン

  • 2024-02: Astral announced uv as a fast Python package installer and resolver written in Rust.
  • 2024-08: Astral announced uv's expansion into unified Python packaging, including projects, tools, scripts, and Python installation.
  • 2024-2026: Official docs list uv across standalone installers, PyPI, Homebrew, MacPorts, WinGet, Scoop, Docker, and CI integrations.

Related projects

  • Ruff is Astral's earlier Rust-written Python linter and formatter and is the closest sibling in toolchain philosophy.
  • pip, pip-tools, pipx, Poetry, PDM, pyenv, twine, and virtualenv are the tools uv explicitly overlaps with or replaces in common Python packaging workflows.

ソース

承認ゲート

危険なコマンドの人手レビュー用メタデータ

ローカルの承認ゲートシードには uv 用のルールが 6 件含まれます。対象エントリポイント: uv, uvx。重大度ラベル: 重大, 高, 中。カバレッジ: partial、レビュー日: 2026-05-21。

ゲート対象アクション例

  • Publish distributions to a Python package index.
  • Install Python packages into an environment.
  • Remove Python packages from an environment.
  • Resolve dependencies and execute a command or script.
  • Synchronize an environment to lockfile or project metadata.
  • Download and execute a Python tool package.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix
~/.local/share/uv/credentials/credentials.toml

実行可能ファイル

インストールされる実行可能ファイル

コマンド種類公開範囲メモ
uv実行可能ファイルインデックス済み実行可能ファイルローカル実行可能ファイルインデックスから検出されました。
uvx実行可能ファイルインデックス済み実行可能ファイルローカル実行可能ファイルインデックスから検出されました。

鮮度

バージョンと鮮度

これらの信号は、ページ生成時期、パッケージマネージャの活動、上流リリース比較を分けて示します。バージョン遅れは、証拠 URL と比較可能なバージョンがある場合だけ警告されます。

ページ生成日2026-08-03
マネージャ版0.12.1
マネージャ更新日2026-07-31
ローカルデータ不明
上流利用不可
検出された最新未検出
  • OK鮮度警告は生成されていません。

インストールメタデータ

パッケージメタデータ

パッケージキーbrew:uv
バージョン0.12.1
パッケージマネージャHomebrew
ホームページhttps://docs.astral.sh/uv/
リポジトリhttps://github.com/astral-sh/uv
最終更新2026-07-31T22:19:31Z
Pulseupdated
Bottle未記録
サービス宣言なし

ソース経路

リポジトリデータから生成

このページは scripts/generate-pkg-sqlite.py が生成した非公開のパッケージ SQLite アーティファクトから av-web によって提供されます。

Combined YAML source

View the package source record on GitHub.

combined/uv.yml

使用ソース

  • Geiger risk classifier
  • Nucleus package database
  • approval-gate seed metadata
  • curated agent safety answer
  • curated configuration and credential file locations
  • curated package history
  • pkgdb category and tag curation