Python uv¶

ID: uv
Home page: https://docs.astral.sh/uv
Version requirement: >= 0.5
Cooldown: ✓
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · outdated · install · upgrade · upgrade_all · remove · cleanup
purl types: pkg:pypi · pkg:uv
CLI name: uv
Every call: uv --color never --no-progress <command>
Issues and PRs: 📦 manager: pypi-based
Source: meta_package_manager/managers/uv.py

Python packages managed with uv’s uv pip interface.

Installed and outdated packages are read with uv pip list (adding --outdated and --format=json), acting on whatever environment uv resolves, exactly as a bare uv pip call in the same shell would. The --outdated listing sets the >=0.5.0 version floor, the first uv release to ship it. The release-age cooldown rides on uv’s --exclude-newer resolver option, which every resolving subcommand honors, so one cutoff covers install, upgrade and outdated together.

Hint

Package specs are passed unquoted, working around uv parse failures on quoted specs.

What `mpm` adds to `uv`¶

Through mpm, uv gains a one-command upgrade --all that refreshes every outdated package in a single run.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover uv alongside pip, pipx and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `uv` commands, in `mpm`¶

You already know uv: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `uv`	With `mpm`
List what’s installed	`uv pip list --format=json`	`mpm --uv installed`
List outdated packages	`uv pip list --outdated --format=json`	`mpm --uv outdated`
Install a package	`uv pip install arrow`	`mpm install pkg:uv/arrow`
Upgrade one package	`uv pip install --upgrade arrow`	`mpm --uv upgrade arrow`
Upgrade everything	—	`mpm --uv upgrade --all`
Remove a package	`uv pip uninstall arrow`	`mpm remove pkg:uv/arrow`
Clear caches	`uv cache clean`	`mpm --uv cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`
`search`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓	backfilled by `mpm`
`remove`	✓
`sync`
`cleanup`	✓
`doctor`

Selecting and configuring `uv`¶

Deselect uv for a single run with --no-uv, or persist the choice in your configuration:

[mpm]
uv = false

The arguments and environment variables listed in the box atop this page are forced on every uv call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.uv]
timeout = 900

mpm config-template uv prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around uv, one mpm command each:

Snapshot and clone a machine: mpm --uv dump uv.toml, then mpm restore uv.toml on the next one.
Export a compliance SBOM: mpm --uv sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

mpm natively enforces its release-age cooldown on Python uv, injecting the UV_EXCLUDE_NEWER environment variable on every call. Point it at a window (mpm --cooldown 7 --uv upgrade --all) to skip anything published in the last 7 days: a guard against a compromised or yanked fresh release landing before anyone notices.

Status: ✅ Enforced
Mechanism: exclude-newer env UV_EXCLUDE_NEWER
Reference: uv docs

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: PyPI (pkg:pypi)
Retraction: Yank (PEP 592): the file stays downloadable, but an installer “MUST ignore yanked releases, if the selection constraints can be satisfied with a non-yanked version”
Publish date: ✅ upload_time_iso_8601, plus a per-file yanked flag (JSON API)

Version probe¶

The version is extracted from the output of uv --version with:

r"uv\s+(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Python uv well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ uv --color never --no-progress pip list --format=json
[
  {
    "name": "markupsafe",
    "version": "2.1.5"
  },
  {
    "name": "meta-package-manager",
    "version": "5.17.0",
    "editable_project_location": "/Users/kde/meta-package-manager"
  },
  {
    "name": "myst-parser",
    "version": "3.0.1"
  }
]

$ uv --color never --no-progress pip list --outdated --format=json
[
  {
    "name": "lark-parser",
    "version": "0.7.8",
    "latest_version": "0.12.0",
    "latest_filetype": "wheel"
  },
  {
    "name": "types-setuptools",
    "version": "75.3.0.20241107",
    "latest_version": "75.3.0.20241112",
    "latest_filetype": "wheel"
  }
]

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --uv installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

7.4.0 (2026-07-25)
- cleanup skips uv’s cache commands when mpm itself was launched by uv run or uvx, whose parent process locks the cache for as long as mpm lives: each uv cache command would otherwise wait on its own ancestor for UV_LOCK_TIMEOUT (300 seconds by default) and fail, stalling the cleanup for ten minutes.
6.0.2 (2026-01-09)
- Workaround uv parsing issues with package specifiers by not quoting them. Closes #1653.
5.19.0 (2024-11-14)
- Implement outdated and cleanup operation.
- Bump minimal requirement to 0.5.0.
- Always invoke uv with --no-progress parameter.
5.17.0 (2024-07-08)
- Add support for uv package manager for Python.

Python uv¶

What mpm adds to uv¶

Your uv commands, in mpm¶

Operations¶

Selecting and configuring uv¶

Recipes¶

Privilege escalation¶

Cooldown¶

Version probe¶

Reference traces¶

Changelog¶

What `mpm` adds to `uv`¶

Your `uv` commands, in `mpm`¶

Selecting and configuring `uv`¶