uv 0.13.6

uv is Astral's free, open-source Python package and project manager, written in Rust. Version 0.13.6 was released on October 26, 2026. Per the release notes, it adds new CPython builds (3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2), cuts peak memory when resolving and locking large workspaces, and fixes several bugs, including one that could delete your files: PR #21464 (opens in a new tab), "Prevent uv run --active --script and uv sync --active --script from deleting non-virtual-environment directories."

How we tested. October 28, 2026, on a Linux box, with the official uv 0.13.5 and 0.13.6 Linux binaries from GitHub (checksums matched). We followed the repro in issue #21364 (opens in a new tab): a normal folder with important.txt and subdir/notes.md, a small script with inline dependencies, then VIRTUAL_ENV=$PWD/target uv run --active --script script.py and the same with uv sync. Scratch folders only, with an isolated uv cache. The full test is in the story.

Pro: The fix works. uv 0.13.5 exited with success, printed only the script's output, and replaced the folder with a virtual environment: both files gone, no warning. uv 0.13.6 stopped with an error ("cannot be replaced because it is a non-empty directory that is not a virtual environment") and left everything in place. Same result for uv sync and for a conda-like folder with its own bin/python.

Con: The new guard looks for a pyvenv.cfg file. Per the PR, uv still replaces folders it considers virtual environments, so don't keep your own files inside a venv. Older uv versions don't have the fix; the bug was first reported on 0.12.7.