uv 0.13.7 stops treating workspace paths as globs and merges aliased OSV records

Serguey Asael Shinder03 November 2026, 08:151 min read

Astral released uv 0.13.7 on 3 November. The most visible fix concerns workspaces: when uv init or uv add adds a member path, uv now treats that path as a literal instead of a glob pattern, so a directory name containing pattern characters is no longer expanded into something else.

Five other bug fixes are listed. uv's Windows trampolines no longer close handles they did not inherit. uvx can now run tools with CPython builds whose version strings contain local identifiers. uv init generates valid module names for packaged projects whose names start with a digit. uv add keeps the comments around an existing inline dependency group when it updates it, and uv remove now works when the inline tool.uv.sources table is empty.

Two changes are preview features. uv workspace metadata gains --output-version for requesting a specific schema version, and uv audit now reports OSV records that are aliases of one another as a single vulnerability rather than several. The release also corrects the cache-keys inline table example in the documentation.

What it means

Nothing in this release changes resolution or lockfiles, so upgrading is low-risk. The audit change matters for anyone who counts findings: the same vulnerability published under several identifiers will now show up once, so a lower number after upgrading is a reporting change, not a fix.