Credential access
Reads Python index credentials, environment variables, and project configuration.
brew / approval gates / rank 26
Extremely fast Python package installer and resolver, written in Rust. Version 0.12.1 via Homebrew; verified 2026-07-31.
agent safety
uv manages Python environments, dependencies, tools, and package publishing workflows.
Reads Python index credentials, environment variables, and project configuration.
Can install packages, resolve remote indexes, and run project commands.
Can build or publish Python packages when paired with packaging commands.
Gate publishing and secret-backed index access; scan project env files first.
Allow lock/test operations; require approval for publish, credentialed index writes, and script execution using secrets.
install
brew install uvprovider-native install command
overview
Extremely fast Python package installer and resolver, written in Rust
history
uv is Astral's Rust-written Python package and project manager. It began as a fast installer and resolver for pip and pip-tools workflows, then expanded into a unified interface for dependency resolution, virtual environments, project management, scripts, tools, and Python installation.
Astral announced uv in February 2024 as the next tool in the same high-performance Python-tooling line as Ruff. The initial public framing was deliberately pragmatic: support common pip and pip-tools APIs under `uv pip`, provide a resolver, virtual environment creator, installer, sync command, and do so without requiring projects to rewrite their packaging workflow.
In August 2024 Astral announced a larger expansion of uv, describing it as moving beyond a pip alternative into an end-to-end solution for Python projects, command-line tools, single-file scripts, and Python itself. The official documentation later presented uv as a single tool replacing or overlapping pip, pip-tools, pipx, poetry, pyenv, twine, virtualenv, and related pieces of the Python packaging stack.
uv's adoption path was shaped by compatibility and speed rather than by a new packaging format alone. Astral emphasized that the first release was production-ready for existing pip and pip-tools workflows and required little configuration for those users.
Package-manager adoption followed the same low-friction pattern. The official installation documentation lists standalone installers, PyPI installation, Homebrew, MacPorts, WinGet, Scoop, Docker images, and other distribution routes, making uv easy to place in developer laptops, CI images, and reproducible build environments.
For package-nerd workflows, uv is commonly used as a faster `pip install`, `pip compile`, `pip sync`, `venv`, and `pipx`-style tool runner. In project mode, it centers dependency state around `pyproject.toml` and `uv.lock`, while retaining a `uv pip` interface for requirements-file and environment-oriented workflows.
The official docs call out a global cache, Cargo-style workspaces, cross-platform installation, and integrations for Docker, GitHub Actions, GitLab CI/CD, pre-commit, PyTorch, FastAPI, Bazel, and several private package registries. Those are the surfaces that made uv especially interesting to people who care about resolver behavior, lockfiles, build reproducibility, and CI runtime.
uv matters in package-manager culture because it compressed several long-standing Python packaging pain points into one fast executable: resolution, installation, environment creation, lockfile generation, tool execution, and Python runtime management. Its significance is not just that it is fast, but that it made speed available through familiar pip-shaped entry points before asking users to adopt its fuller project model.
It also accelerated the Rust-based rewrite trend in Python infrastructure. Like Ruff for linting and formatting, uv made performance a central product argument and forced comparisons with older Python-native tools such as pip-tools, Poetry, PDM, pipx, and virtualenv.
approval gates
The local approval-gate seed includes 6 rules for uv. Covered entrypoints: uv, uvx. Severity labels: critical, high, medium. Coverage: partial, reviewed 2026-05-21.
local files
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Credential-bearing paths to review before unattended agent runs.
~/.local/share/uv/credentials/credentials.tomlexecutables
| Command | Kind | Exposure | Note |
|---|---|---|---|
uv | executable | indexed executable | Discovered from the local executable index. |
uvx | executable | indexed executable | Discovered from the local executable index. |
freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
install metadata
| Package key | brew:uv |
|---|---|
| Version | 0.12.1 |
| Package manager | Homebrew |
| Homepage | https://docs.astral.sh/uv/ |
| Repository | https://github.com/astral-sh/uv |
| Last updated | 2026-07-31T22:19:31Z |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source trail
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
View the package source record on GitHub.