pkg.sopackage field notes

brew / approval gates / rank 26

Install uv with Homebrew

Extremely fast Python package installer and resolver, written in Rust. Version 0.12.1 via Homebrew; verified 2026-07-31.

agent safety

Agent safety answer

uv manages Python environments, dependencies, tools, and package publishing workflows.

Credential access

Reads Python index credentials, environment variables, and project configuration.

Remote mutation

Can install packages, resolve remote indexes, and run project commands.

Publish/artifact risk

Can build or publish Python packages when paired with packaging commands.

Recommended control

Gate publishing and secret-backed index access; scan project env files first.

Agent-use guidance

Allow lock/test operations; require approval for publish, credentialed index writes, and script execution using secrets.

install

Additional install commands

macOS

Homebrewverified · 100%
brew install uv

provider-native install command

overview

Package summary

Extremely fast Python package installer and resolver, written in Rust

Commands and aliases

  • uv
  • uvx

history

Project history and usage

uv is Astral's Rust-written Python package and project manager. It began as a fast installer and resolver for pip and pip-tools workflows, then expanded into a unified interface for dependency resolution, virtual environments, project management, scripts, tools, and Python installation.

Project history

Astral announced uv in February 2024 as the next tool in the same high-performance Python-tooling line as Ruff. The initial public framing was deliberately pragmatic: support common pip and pip-tools APIs under `uv pip`, provide a resolver, virtual environment creator, installer, sync command, and do so without requiring projects to rewrite their packaging workflow.

In August 2024 Astral announced a larger expansion of uv, describing it as moving beyond a pip alternative into an end-to-end solution for Python projects, command-line tools, single-file scripts, and Python itself. The official documentation later presented uv as a single tool replacing or overlapping pip, pip-tools, pipx, poetry, pyenv, twine, virtualenv, and related pieces of the Python packaging stack.

Adoption history

uv's adoption path was shaped by compatibility and speed rather than by a new packaging format alone. Astral emphasized that the first release was production-ready for existing pip and pip-tools workflows and required little configuration for those users.

Package-manager adoption followed the same low-friction pattern. The official installation documentation lists standalone installers, PyPI installation, Homebrew, MacPorts, WinGet, Scoop, Docker images, and other distribution routes, making uv easy to place in developer laptops, CI images, and reproducible build environments.

How it is used

For package-nerd workflows, uv is commonly used as a faster `pip install`, `pip compile`, `pip sync`, `venv`, and `pipx`-style tool runner. In project mode, it centers dependency state around `pyproject.toml` and `uv.lock`, while retaining a `uv pip` interface for requirements-file and environment-oriented workflows.

The official docs call out a global cache, Cargo-style workspaces, cross-platform installation, and integrations for Docker, GitHub Actions, GitLab CI/CD, pre-commit, PyTorch, FastAPI, Bazel, and several private package registries. Those are the surfaces that made uv especially interesting to people who care about resolver behavior, lockfiles, build reproducibility, and CI runtime.

Why package nerds care

uv matters in package-manager culture because it compressed several long-standing Python packaging pain points into one fast executable: resolution, installation, environment creation, lockfile generation, tool execution, and Python runtime management. Its significance is not just that it is fast, but that it made speed available through familiar pip-shaped entry points before asking users to adopt its fuller project model.

It also accelerated the Rust-based rewrite trend in Python infrastructure. Like Ruff for linting and formatting, uv made performance a central product argument and forced comparisons with older Python-native tools such as pip-tools, Poetry, PDM, pipx, and virtualenv.

Timeline

  • 2024-02: Astral announced uv as a fast Python package installer and resolver written in Rust.
  • 2024-08: Astral announced uv's expansion into unified Python packaging, including projects, tools, scripts, and Python installation.
  • 2024-2026: Official docs list uv across standalone installers, PyPI, Homebrew, MacPorts, WinGet, Scoop, Docker, and CI integrations.

Related projects

  • Ruff is Astral's earlier Rust-written Python linter and formatter and is the closest sibling in toolchain philosophy.
  • pip, pip-tools, pipx, Poetry, PDM, pyenv, twine, and virtualenv are the tools uv explicitly overlaps with or replaces in common Python packaging workflows.

Sources

approval gates

Human review metadata for risky commands

The local approval-gate seed includes 6 rules for uv. Covered entrypoints: uv, uvx. Severity labels: critical, high, medium. Coverage: partial, reviewed 2026-05-21.

Example gated actions

  • Publish distributions to a Python package index.
  • Install Python packages into an environment.
  • Remove Python packages from an environment.
  • Resolve dependencies and execute a command or script.
  • Synchronize an environment to lockfile or project metadata.
  • Download and execute a Python tool package.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix
~/.local/share/uv/credentials/credentials.toml

executables

Installed executables

CommandKindExposureNote
uvexecutableindexed executableDiscovered from the local executable index.
uvxexecutableindexed executableDiscovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03
manager version0.12.1
manager updated2026-07-31
local dataunknown
upstreamnot available
latest detectednot detected
  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:uv
Version0.12.1
Package managerHomebrew
Homepagehttps://docs.astral.sh/uv/
Repositoryhttps://github.com/astral-sh/uv
Last updated2026-07-31T22:19:31Z
Pulseupdated
Bottlenot recorded
Servicenone declared

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/uv.yml

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • approval-gate seed metadata
  • curated agent safety answer
  • curated configuration and credential file locations
  • curated package history
  • pkgdb category and tag curation