56 results available
Sign in
Skills directory

uv-package-manager

wshobson

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 7 targeted changes and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 1. Classified findings remaining: 5. Unclassified scanner findings remaining: 0. Review findings closed: 5. Review findings remaining: 8.


Open before hardening

1

High

1

Medium

4

Low
Open after hardening

1

Medium

4

Low

Expand
File
Group
Subtype
Severity
Status
references/advanced-patterns.md

Malicious / Backdoor Behavior

Known malware signature

High
Closed
references/advanced-patterns.md

Excessive Agency & Rogue Autonomy

—

Medium
Open
SKILL.md

Malicious Code & Command Execution

—

Low
Open
SKILL.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Open
references/advanced-patterns.md

Malicious Code & Command Execution

—

Low
Open
references/advanced-patterns.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Open

6 findings


SKILL.md

UV Package Manager

Comprehensive guide to using uv, an extremely fast Python package installer and resolver written in Rust, for modern Python project management and dependency workflows.

When to Use This Skill

  • Setting up new Python projects quickly
  • Managing Python dependencies faster than pip
  • Creating and managing virtual environments
  • Installing Python interpreters
  • Resolving dependency conflicts efficiently
  • Migrating from pip/pip-tools/poetry
  • Speeding up CI/CD pipelines
  • Managing monorepo Python projects
  • Working with lockfiles for reproducible builds
  • Optimizing Docker builds with Python dependencies

Core Concepts

1. What is uv?

  • Ultra-fast package installer: 10-100x faster than pip
  • Written in Rust: Leverages Rust's performance
  • Drop-in pip replacement: Compatible with pip workflows
  • Virtual environment manager: Create and manage venvs
  • Python installer: Download and manage Python versions
  • Resolver: Advanced dependency resolution
  • Lockfile support: Reproducible installations

2. Key Features

  • Blazing fast installation speeds
  • Disk space efficient with global cache
  • Compatible with pip, pip-tools, poetry
  • Comprehensive dependency resolution
  • Cross-platform support (Linux, macOS, Windows)
  • No Python required for installation
  • Built-in virtual environment support

3. UV vs Traditional Tools

  • vs pip: 10-100x faster, better resolver
  • vs pip-tools: Faster, simpler, better UX
  • vs poetry: Faster, less opinionated, lighter
  • vs conda: Faster, Python-focused

Installation

Quick Install

# Using Homebrew (macOS or Linux)
brew install uv

# Using Cargo (if you have Rust)
cargo install --locked uv

On Windows, use WinGet:

winget install --id=astral-sh.uv -e

Use the official installation guide for other supported installation methods.

Verify Installation

uv --version
# uv 0.x.x

Quick Start

Create a New Project

# Create new project with virtual environment
uv init my-project
cd my-project

# Or create in current directory
uv init .

# Initialize creates:
# - .python-version (Python version)
# - pyproject.toml (project config)
# - README.md
# - .gitignore

Install Dependencies

# Install packages (creates venv if needed)
uv add requests pandas

# Install dev dependencies
uv add --dev pytest black ruff

# Install from requirements.txt
uv pip install -r requirements.txt

# Install from pyproject.toml
uv sync

Virtual Environment Management

Pattern 1: Creating Virtual Environments

# Create virtual environment with uv
uv venv

# Create with specific Python version
uv venv --python 3.12

# Create with custom name
uv venv my-env

# Create with system site packages
uv venv --system-site-packages

# Specify location
uv venv /path/to/venv

Pattern 2: Activating Virtual Environments

# Linux/macOS
source .venv/bin/activate

# Windows (Command Prompt)
.venv\Scripts\activate.bat

# Windows (PowerShell)
.venv\Scripts\Activate.ps1

# Or use uv run (no activation needed)
uv run python script.py
uv run pytest

Pattern 3: Using uv run

# Run Python script (auto-activates venv)
uv run python app.py

# Run installed CLI tool
uv run black .
uv run pytest

# Run with specific Python version
uv run --python 3.11 python script.py

# Pass arguments
uv run python script.py --arg value

Package Management

Pattern 4: Adding Dependencies

# Add package (adds to pyproject.toml)
uv add requests

# Add with version constraint
uv add "django>=4.0,<5.0"

# Add multiple packages
uv add numpy pandas matplotlib

# Add dev dependency
uv add --dev pytest pytest-cov

# Add optional dependency group
uv add --optional docs sphinx

# Add from git
uv add git+https://github.com/user/repo.git

# Add from git with specific ref
uv add git+https://github.com/user/repo.git@v1.0.0

# Add from local path
uv add ./local-package

# Add editable local package
uv add -e ./local-package

Pattern 5: Removing Dependencies

# Remove package
uv remove requests

# Remove dev dependency
uv remove --dev pytest

# Remove multiple packages
uv remove numpy pandas matplotlib

Pattern 6: Upgrading Dependencies

# Upgrade specific package
uv add --upgrade requests

# Upgrade all packages
uv sync --upgrade

# Show what would be upgraded
uv tree --outdated

Pattern 7: Locking Dependencies

# Generate uv.lock file
uv lock

# Update lock file
uv lock --upgrade

# Lock specific package
uv lock --upgrade-package requests

Python Version Management

Pattern 8: Installing Python Versions

# Install Python version
uv python install 3.12

# Install multiple versions
uv python install 3.11 3.12 3.13

# Install latest version
uv python install

# List installed versions
uv python list

# Find available versions
uv python list --all-versions

Pattern 9: Setting Python Version

# Set Python version for project
uv python pin 3.12

# This creates/updates .python-version file

# Use specific Python version for command
uv --python 3.11 run python script.py

# Create venv with specific version
uv venv --python 3.12

Project Configuration

Pattern 10: pyproject.toml with uv

[project]
name = "my-project"
version = "0.1.0"
description = "My awesome project"
readme = "README.md"
requires-python = ">=3.8"
dependencies = [
    "requests>=2.31.0",
    "pydantic>=2.0.0",
    "click>=8.1.0",
]

[project.optional-dependencies]
dev = [
    "pytest>=7.4.0",
    "pytest-cov>=4.1.0",
    "black>=23.0.0",
    "ruff>=0.1.0",
    "mypy>=1.5.0",
]
docs = [
    "sphinx>=7.0.0",
    "sphinx-rtd-theme>=1.3.0",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.uv.sources]
# Custom package sources
my-package = { git = "https://github.com/user/repo.git" }

Pattern 11: Using uv with Existing Projects

# Migrate from requirements.txt
uv add -r requirements.txt

# Migrate from poetry
# Already have pyproject.toml, just use:
uv sync

# Export to requirements.txt
uv pip freeze > requirements.txt

For advanced workflows including Docker integration, lockfile management, performance optimization, tool comparison, common workflows, tool integration, troubleshooting, best practices, migration guides, and command reference, see references/advanced-patterns.md

Install

Install with chainctl
chainctl skill install public/wshobson/uv-package-manager:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/wshobson/agents
Upstream commit46891e7e60da0e52baf1050b7b6391b64e84c6d9
OCI reference

skills.cgr.dev/public/github.com/wshobson/plugins/python-development/skills/uv-package-manager:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md

references/advanced-patterns.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.