astral-sh/uv

69.5

Adequate · 29 July 2026

262.6k

lines of production code

Rust

primary language

2

measurements over time

How this codebase got here

This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.

Score

CAI 66 → 70 (+3.7)
Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

Lenses

Code Health 68 → 65 (-2.4)
Architecture 97 → 96 (-0.9)
Maturity 58 → 70 (+11.6)
Readiness 65 → 65 (+0.0)
Security 76 → 81 (+4.3)
Domain Modelling 100 → 100 (+0.0)
Event Sourcing 100 → 100 (+0.0)

Resolved (81)

BatchPrefetcherRunner.send_prefetch (cyclomatic 16) (crates/uv-resolver/src/resolver/batch_prefetch.rs)
CacheControl.from_iter (cognitive 21) (crates/uv-client/src/httpcache/control.rs)
Change coupling: abi_tag.rs ↔ language_tag.rs (crates/uv-platform-tags/src/abi_tag.rs)
Change coupling: install.rs ↔ sync.rs (crates/uv/src/commands/pip/install.rs)
Change coupling: lib.rs ↔ build_backend.rs (crates/uv-build-backend/src/lib.rs)
Change coupling: remove.rs ↔ run.rs (crates/uv/src/commands/project/remove.rs)
Change coupling: remove.rs ↔ sync.rs (crates/uv/src/commands/project/remove.rs)
Dependency hygiene not measured — no supported dependency manifest was read
DerivationChainBuilder.from_state (cognitive 31) (crates/uv-resolver/src/resolver/derivation.rs)
DisplaySafeUrl.try_from (cognitive 20) (crates/uv-pypi-types/src/direct_url.rs)
DistributionDatabase.build_wheel (cognitive 18) (crates/uv-distribution/src/distribution_database.rs)
FlatDependencyGroups.from_dependency_groups (cognitive 20) (crates/uv-workspace/src/dependency_groups.rs)
FlatDependencyGroups.from_dependency_groups (cyclomatic 16) (crates/uv-workspace/src/dependency_groups.rs)
High: security finding (details withheld)
Hotspot: crates/uv-resolver/src/pubgrub/report.rs (crates/uv-resolver/src/pubgrub/report.rs)
Hotspot: crates/uv-resolver/src/resolver/mod.rs (crates/uv-resolver/src/resolver/mod.rs)
IncompatibleDist.plural_message (cyclomatic 18) (crates/uv-distribution-types/src/prioritized_distribution.rs)
IncompatibleDist.singular_message (cyclomatic 18) (crates/uv-distribution-types/src/prioritized_distribution.rs)
InstallTarget.validate_groups (cognitive 18) (crates/uv/src/commands/project/install_target.rs)
IterativeReporter.build (cyclomatic 18) (crates/uv-resolver/src/pubgrub/report.rs)
…and 61 more

New (120)

Change coupling: build_requires.rs ↔ requires_dist.rs (crates/uv-distribution/src/metadata/build_requires.rs)
Change coupling: lib.rs ↔ mod.rs (crates/uv-cli/src/lib.rs)
Change coupling: prerelease.rs ↔ resolution_mode.rs (crates/uv-resolver/src/prerelease.rs)
Change coupling: registry_client.rs ↔ base_url.rs (crates/uv-client/src/registry_client.rs)
Change coupling: sync.rs ↔ uninstall.rs (crates/uv/src/commands/pip/sync.rs)
Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
DerivationChainBuilder::from_state::find_path (cognitive 30) (crates/uv-resolver/src/resolver/derivation.rs)
DistributionDatabase::download_wheel (cyclomatic 16) (crates/uv-distribution/src/distribution_database.rs)
DistributionDatabase::stream_wheel (cognitive 16) (crates/uv-distribution/src/distribution_database.rs)
FileTooLong: commands/build_frontend.rs (crates/uv/src/commands/build_frontend.rs)
FileTooLong: commands/reporters.rs (crates/uv/src/commands/reporters.rs)
FileTooLong: commands/self_update.rs (crates/uv/src/commands/self_update.rs)
FileTooLong: export/metadata.rs (crates/uv-resolver/src/lock/export/metadata.rs)
FileTooLong: export/pylock_toml.rs (crates/uv-resolver/src/lock/export/pylock_toml.rs)
FileTooLong: httpcache/mod.rs (crates/uv-client/src/httpcache/mod.rs)
FileTooLong: lock/installable.rs (crates/uv-resolver/src/lock/installable.rs)
FileTooLong: lock/mod.rs (crates/uv-resolver/src/lock/mod.rs)
FileTooLong: lock/serialize.rs (crates/uv-resolver/src/lock/serialize.rs)
FileTooLong: lock/tree.rs (crates/uv-resolver/src/lock/tree.rs)
FileTooLong: marker/algebra.rs (crates/uv-pep508/src/marker/algebra.rs)
…and 100 more

Changes since last survey

201 commits — 182 feature/other, 19 fixes

By area

crates/uv — 54 commits
(root) — 53 commits
.github/workflows — 43 commits
crates/uv-resolver — 8 commits
crates/uv-python — 6 commits
.github/automations-dispatch.json — 5 commits
.github/ost-simple-sts.json — 4 commits
crates/uv-cli — 3 commits
docs/concepts — 3 commits
(repo) — 2 commits
agents/prompts — 2 commits
crates/uv-client — 2 commits
crates/uv-preview — 2 commits
crates/uv-pypi-types — 2 commits
agents/references — 1 commit
crates/uv-dev — 1 commit
crates/uv-distribution — 1 commit
crates/uv-distribution-types — 1 commit
crates/uv-fs — 1 commit
crates/uv-install-wheel — 1 commit

Notable commits

fix: Add integration tests for reproducible bugs (#20475)
fix: Classify source-confirmed correctness issues as bugs (#20619)
fix: Enable Ruff default lint rules across the repository (and fix all the errors) (#20650)
fix: Fix JSON schema validation with fastjsonschema (#20550)
fix: Fix discrepancies in argument parsing of exclude-newer (#20679)
fix: Fix inclusion of extra specified in dependency group when listed in a conflict (#20237)
fix: Fix misleading pip compile --emit-options error (#20582)
fix: Fix more assorted comments (#20624)
fix: Fix more overzealous snapshot filters (#20627)
fix: Fix up uv-fs::path::Simplified::simple_canonicalize comment (#20581)
fix: Fix uv check workspace snapshots and ruff lints (#20649)
fix: Fix validate-pyproject-schema-store 2026.07.20 regression (#20547)
fix: Fix various comments (#20597)
fix: Fix windows test warnings (#20755)
fix: Ignore Codex runtime files when creating bug tests (#20674)
fix: Keep bug reproduction tests passing and colocated (#20750)
fix: Replace ignored regression tests with new packse versions (#20629)
fix: Revert changes to workflows for 0.11.30 (#20563)
fix: fix(python): allow managed python temp_dir to clean up on drop (#20752)
change: Abort panics in release builds for smaller binaries (#20271)
…and 181 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

Survey your own repository

astral-sh/uv was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.

About this page

The score is its most recent published measurement, taken on 29 July 2026 at a pinned commit. It is not a live figure and does not change until the project is measured again.
Measured at commit ddc1deb0c9f088ee0d6f4086110c0dd159849726 — the exact code this score is about.
Scored under rubric-2026.08.18 — the same rubric and the same method as every other entry in this index.
Measured by watchdog.canine.dev using codehealth-analyzer latest.