Bump version to v0.8.6 (#15137)

Author: charliermarsh

CHANGELOG.md

@@ -2,6 +2,41 @@
 
 <!-- prettier-ignore-start -->
 
+## 0.8.6
+
+This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parser (CVE-2025-54368).
+
+Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs.
+
+Thanks to a triage effort with the [Python Security Response Team](https://devguide.python.org/developer-workflow/psrt/) and PyPI maintainers, we were able to determine that these differentials **were not exploited** via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload.
+
+Although the practical risk of exploitation is low, we take the _hypothetical_ risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this advisory a CVE identifier and have given it a "moderate" severity suggestion.
+
+These changes have been validated against the top 15,000 PyPI packages; however, it's plausible that a non-malicious ZIP could be falsely rejected with this additional hardening. As an escape hatch, users who do encounter breaking changes can enable `UV_INSECURE_NO_ZIP_VALIDATION` to restore the previous behavior. If you encounter such a rejection, please file an issue in uv and to the upstream package.
+
+### Security
+
+- Harden ZIP streaming to reject repeated entries and other malformed ZIP files ([#15136](https://github.com/astral-sh/uv/pull/15136))
+
+### Enhancements
+
+- Sync latest Python releases ([#15135](https://github.com/astral-sh/uv/pull/15135))
+
+### Configuration
+
+- Add support for per-project build-time environment variables ([#15095](https://github.com/astral-sh/uv/pull/15095))
+
+### Bug fixes
+
+- Avoid invalid simplification with conflict markers  ([#15041](https://github.com/astral-sh/uv/pull/15041))
+- Respect `UV_HTTP_RETRIES` in `uv publish` ([#15106](https://github.com/astral-sh/uv/pull/15106))
+- Support `UV_NO_EDITABLE` where `--no-editable` is supported ([#15107](https://github.com/astral-sh/uv/pull/15107))
+- Upgrade `cargo-dist` to add `UV_INSTALLER_URL` to PowerShell installer ([#15114](https://github.com/astral-sh/uv/pull/15114))
+- Upgrade `h2` again to avoid `too_many_internal_resets` errors ([#15111](https://github.com/astral-sh/uv/pull/15111))
+
+### Documentation
+
+- Ensure symlink warning is shown ([#15126](https://github.com/astral-sh/uv/pull/15126))
 
 ## 0.8.5
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "uv-build"
-version = "0.8.5"
+version = "0.8.6"
 edition = { workspace = true }
 rust-version = { workspace = true }
 homepage = { workspace = true }

crates/uv-build/Cargo.toml

@@ -1,6 +1,6 @@
 [project]
 name = "uv-build"
-version = "0.8.5"
+version = "0.8.6"
 description = "The uv build backend"
 authors = [{ name = "Astral Software Inc.", email = "[email protected]" }]
 requires-python = ">=3.8"

crates/uv-build/pyproject.toml

@@ -1,6 +1,6 @@
 [package]
 name = "uv-version"
-version = "0.8.5"
+version = "0.8.6"
 edition = { workspace = true }
 rust-version = { workspace = true }
 homepage = { workspace = true }

crates/uv-version/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "uv"
-version = "0.8.5"
+version = "0.8.6"
 edition = { workspace = true }
 rust-version = { workspace = true }
 homepage = { workspace = true }

crates/uv/Cargo.toml

@@ -31,7 +31,7 @@ To use uv as a build backend in an existing project, add `uv_build` to the
 
 ```toml title="pyproject.toml"
 [build-system]
-requires = ["uv_build>=0.8.5,<0.9.0"]
+requires = ["uv_build>=0.8.6,<0.9.0"]
 build-backend = "uv_build"
 ```
 

docs/concepts/build-backend.md

@@ -111,7 +111,7 @@ dependencies = []
 example-pkg = "example_pkg:main"
 
 [build-system]
-requires = ["uv_build>=0.8.5,<0.9.0"]
+requires = ["uv_build>=0.8.6,<0.9.0"]
 build-backend = "uv_build"
 ```
 
@@ -134,7 +134,7 @@ dependencies = []
 example-pkg = "example_pkg:main"
 
 [build-system]
-requires = ["uv_build>=0.8.5,<0.9.0"]
+requires = ["uv_build>=0.8.6,<0.9.0"]
 build-backend = "uv_build"
 ```
 
@@ -195,7 +195,7 @@ requires-python = ">=3.11"
 dependencies = []
 
 [build-system]
-requires = ["uv_build>=0.8.5,<0.9.0"]
+requires = ["uv_build>=0.8.6,<0.9.0"]
 build-backend = "uv_build"
 ```
 

docs/concepts/projects/init.md

@@ -75,7 +75,7 @@ bird-feeder = { workspace = true }
 members = ["packages/*"]
 
 [build-system]
-requires = ["uv_build>=0.8.5,<0.9.0"]
+requires = ["uv_build>=0.8.6,<0.9.0"]
 build-backend = "uv_build"
 ```
 
@@ -106,7 +106,7 @@ tqdm = { git = "https://github.com/tqdm/tqdm" }
 members = ["packages/*"]
 
 [build-system]
-requires = ["uv_build>=0.8.5,<0.9.0"]
+requires = ["uv_build>=0.8.6,<0.9.0"]
 build-backend = "uv_build"
 ```
 
@@ -188,7 +188,7 @@ dependencies = ["bird-feeder", "tqdm>=4,<5"]
 bird-feeder = { path = "packages/bird-feeder" }
 
 [build-system]
-requires = ["uv_build>=0.8.5,<0.9.0"]
+requires = ["uv_build>=0.8.6,<0.9.0"]
 build-backend = "uv_build"
 ```
 

docs/concepts/projects/workspaces.md

@@ -25,7 +25,7 @@ uv provides a standalone installer to download and install uv:
     Request a specific version by including it in the URL:
 
     ```console
-    $ curl -LsSf https://astral.sh/uv/0.8.5/install.sh | sh
+    $ curl -LsSf https://astral.sh/uv/0.8.6/install.sh | sh
     ```
 
 === "Windows"
@@ -41,7 +41,7 @@ uv provides a standalone installer to download and install uv:
     Request a specific version by including it in the URL:
 
     ```pwsh-session
-    PS> powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/0.8.5/install.ps1 | iex"
+    PS> powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/0.8.6/install.ps1 | iex"
     ```
 
 !!! tip