uv 0.12.10 Revokes PyPI Trusted Publishing Tokens After uv publish

What shipped

uv 0.12.10, released September 4, 2026. The Python package manager's headline change is a security hygiene fix to uv publish.

What changed

• Token burning. After uv publish completes, uv now attempts to revoke the short-lived PyPI trusted-publishing token it minted — including when publishing fails (PR #21423, "uv publish: support token burning"). Previously a failed or crashed publish could leave the freshly issued token valid for the rest of its lifetime.
• Faster publishing. Artifacts are hashed in a single blocking task with buffer reuse across reads, cutting uv publish upload prep time.
• Lockfile fixes. --locked no longer fails when exclude-newer-package settings differ only for packages outside the resolution; uv lock --check reuses lockfiles when absolute or package-specific exclude-newer cutoffs move or get disabled; cutoffs are written to uv.lock deterministically.
• Preview: uv tree --invert shows terminal dependency cycles.

Why a builder cares

Trusted publishing mints a fresh OIDC token on every release. A flaky upload that dies mid-run used to strand that credential — still valid, still in the CI environment. Now uv burns it on the way out, failed or not. Your release credentials shouldn't outlive the job that used them; uv is the first major Python publisher to enforce that automatically.