uv crossed 86,000 GitHub stars by behaving less like a package installer and more like a strategy. Astral's Rust toolchain already swallowed pip, venv, pyenv, and pipx into one binary, and the 0.11.19 release on June 3, 2026 shows the appetite is not satisfied. Two themes run through it: tighten the supply chain, and keep widening the surface uv covers.
Start with the supply chain, because it is the change everyone benefits from and nobody will notice. uv 0.11.19 now always computes a SHA256 for remote distributions. That is the unglamorous plumbing that lets a lockfile mean something: a hash recorded today is a hash you can verify on every machine that resolves the same dependency tomorrow. For a tool whose entire pitch is reproducible, fast installs, hashing everything by default is the feature that should have a parade and instead gets one line in the changelog.
The more telling change shipped the day before. uv 0.11.18 added uv check, which runs ty, Astral's own type checker, directly from uv as a preview. Read that slowly. The package manager now has a subcommand that type-checks your code. uv 0.11.19 then added the PyEmscripten platform from PEP 783 and a Pyodide 2025 target triple, which means uv is also learning to target Python in the browser via WebAssembly. The installer is becoming an installer, resolver, runner, type checker, and cross-compilation target manager.
Here is what uv now reaches into, against the single-purpose tools it is replacing:
Comparison data
| Installs Python | Resolves + locks | Runs tools | Type-check | |
|---|---|---|---|---|
| uv | Yes | Yes | Yes | ty (preview) |
| pip + venv | No | No | No | No |
| poetry | No | Yes | No | No |
| pyenv | Yes | No | No | No |
| pipx | No | No | Yes | No |
None of this is a complaint about quality. uv is fast, the resolver is good, and consolidating five tools into one genuinely removes a category of "which Python, which venv, which lockfile" pain that has cost Python teams years. The supply-chain work is the kind of thing you only appreciate after a dependency-confusion incident somewhere else.
The honest caveat is structural, not technical. When your installer, your resolver, your task runner, and now your type checker all ship from the same vendor on the same release cadence, you have not just adopted a tool. You have standardized your entire Python entry point on Astral. That is probably a good bet right now, given the execution. It is still a bet, and the time to notice you made it is before uv check is the only type checker your CI knows how to call, not after.
Use uv. Pin the version, let it hash your downloads, and try uv check while it is still a preview you opted into rather than a default you inherited.