uv 0.12 makes every new project a package: src/ layout by default
The July 28 release also flips pre-release resolution to stable-first and rejects legacy sdists, exotic wheels, and bad cert paths — quiet CI-breakers.
Copy markdown
`uv init` now scaffolds a real package
New projects declare a `[build-system]` using `uv_build`, put code in `src/<name>/`, and add a `[project.scripts]` entry — so `uv run <name>` runs it and the project is importable and installable from day one. Want the old flat `main.py`? Run `uv init --no-package`.
Pre-releases: stable-first is now the default
The resolver default moved from `if-necessary-or-explicit` to `if-necessary`, matching pip — uv tries stable candidates first and only falls back to pre-releases when a constraint forces it. If you leaned on the old behavior, set your pre-release mode explicitly.
Stricter supply-chain defaults that can bite CI
Only PEP 625 `.tar.gz` sdists are accepted (`.tar.bz2` and `.tar.xz` are rejected), wheels compressed with bzip2/LZMA/XZ are refused, `--require-hashes` now switches on full hash-checking (MD5-only hashes rejected), and an invalid `SSL_CERT_FILE` or `SSL_CERT_DIR` now hard-fails HTTPS instead of silently using defaults. Audit lockfiles and cert env vars before upgrading.
Scripts resolve deps from their own folder
`uv run other-project/script.py` now discovers dependencies from the script's directory rather than your current working directory — cleaner for monorepos, but a real behavior change if your tooling assumed cwd.