Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

Security News

uv: Python's New High-Speed Package Manager Promises to Simplify Tooling

uv, Python's new package manager, offers a faster and more efficient alternative to pip with features that simplify tooling, manage Python versions, and streamline development workflows.

uv: Python's New High-Speed Package Manager Promises to Simplify Tooling

Sarah Gooding

August 28, 2024


Python has a new package manager. Astral, a startup centered around creating Python tooling, made a big splash in February when it first released uv as a drop-in alternative to pip, pip-tools, and virtualenv. The package manager is written in Rust and boasts speeds that are 10-100x faster than pip, as shown by these example metrics for installing Trio's dependencies with a warm cache.

This major update to uv moves the tool closer to realizing Astral's vision of it becoming the 'Cargo for Python.’ A few of the new feature highlights include:

  • End-to-end project management: uv manages project dependencies and environments, with support for lockfiles, workspaces, and more, similar to rye or poetry.
  • Tool management: uv executes and installs command-line tools provided by Python packages, similar to pipx.
  • Python installation: uv installs Python and allows quickly switching between versions.
  • Script execution: uv manages dependencies and environments for single-file scripts.

uv is Fast with the Potential to Replace Existing Tools#

The Astral team is known for its work on Ruff, a Python linter and formatter that also has a strong focus on performance. These tools constitute some of the most significant recent additions to the Python ecosystem, and the performance claims aren’t just marketing hype. Community feedback confirms that uv is notably faster than its predecessors.

“The paint isn't even dry on this stuff - it's only been out for a few hours - but this feels very promising to me,” Django co-creator Simon Wilson said. “The idea that you can install uv (a single Rust binary) and then start running all of these commands to manage Python installations and their dependencies is very appealing.”

uv was among GitHub’s trending repositories over the weekend, as the community’s excitement coalesced around its potential to replace some of Python’s more established tools. uv simplifies the experience of building with Python by reducing the number of required tools.

Astral founder Charlie Marsh recently appeared on the Bite Code podcast and explained how they to ship a series of packaging interfaces for working with Python projects and packages:

For example, for people that have used Poetry or PDM in the past, we now have a similar way to manage Python projects. So you declare your dependencies, and then we create a lock file for you. We have the uv run interface that will automatically resolve your dependencies, create a virtual environment, populate it, and then run the command in the virtual environment. So if you use that, you don't have to think about all those manual, what used to be manual commands of like create the environment, resolve the dependencies, install them into the environment, activate it. So it's an attempt to introduce these kind of higher level workflows that if you follow them, right, they require some changes in your behavior. But if you follow them, they can take a lot of the complexity out of it.

In the latest release, uv can now install and manage your Python installation for you, which makes it much faster to get up and running on a project.

“It means that you can install UV and start running stuff, and it will just install Python for you if you don't have it already,” Marsh said. “So you don't need to have Python installed on your system necessarily to get started and work with UV.

“Also, if you need to test on a bunch of different versions, we can install all those versions for you. It all just happens as you use UV. And then we also added a bunch of APIs around working with Python outside of the context of projects.”

Building a pip Alternative: How uv Is Reimagining Python Tooling with Inspiration from Rust#

Astral has completely reimagined how people build with Python with uv’s latest release. They are currently a team of eight people, and everything they build is open source, heavily inspired by Cargo and the Rust ecosystem.

“We work in rust, we build all our stuff and all our tools in rust, and rust has really, really good tooling,” Marsh said. “And Rust is in a very different position from Python, because in Python, everything evolved over a long period of time very organically. We didn't have as much experience as a programming community at building and designing these kinds of systems.

“With Rust, it's a much newer language and ecosystem, and they had the opportunity to really consider, ‘What do we want the tooling experience to be?’ and to take lessons from other ecosystems and other communities. And so Rust has this sort of non-first mover advantage of learning from lots of other ecosystems.”

Marsh explained how the Astral team has tried to take some lessons and things they like about Cargo and translate them to Python. They don’t always translate, but they have taken a great deal of inspiration from Rust, as well as existing tools in the Python ecosystem like PipX that people enjoy using.

“We wanted to create something that was really easy for people to use, that people could adopt with minimal friction, in part because it meant we invested a lot of time in building a really good package resolver and package installer,” he said.

After releasing uv in February as a basic pip alternative, they started getting more adoption, more testing, and consequently, a lot more bugs. Astral continued to improve it over the past few months with features to make Python developers more productive.

“From our perspective, pip is kind of a low-level tool,” Marsh said. “If you think about the way that you use pip, it's like you have an environment and then you ask pip to install a package into that environment or remove a package from that environment.

“In a lot of other ecosystems and in some other Python tools, you get to work at a slightly higher level. So typically, you're saying things like, ‘These are the dependencies for my project. Just make sure that they're all installed at the right versions and that the environment is all set up for me to work in’. And you don't have to think about, where's my virtual environment? Is it up to date? I just uninstalled something. Did it uninstall everything or did it just uninstall the thing? Just keeping everything in sync.

“So our goal was always to build something that was higher level and that we hoped would solve more of the problems that people have with Python packaging.”

The latest release represents the Astral team’s attempt to take uv beyond being just a pip alternative and into a higher level tool that reduces friction in Python development. There’s an undeniable buzz around uv’s potential to streamline workflows and replace older tools. So far the community reception has been enthusiastic with early predictions of uv rapidly gaining broad adoption.

Subscribe to our newsletter

Get notified when we publish new security blog posts!

Try it now

Ready to block malicious and vulnerable dependencies?

Install GitHub AppBook a demo

Related posts

Back to all posts
SocketSocket SOC 2 Logo

Product

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc