Loopwerk: uv is fantastic, but its package management UX is a mess

Astral’s uv has quickly become a favorite among Python developers for its speed and unified toolchain. Its ability to replace multiple utilities with a single binary has drawn praise from those tired of juggling venv, pip, and pip-tools.

Getting a new project off the ground with uv feels straightforward. Running uv init followed by uv add for first dependencies creates a clean pyproject.toml and lockfile in seconds.

The experience shifts when routine maintenance begins. Checking for outdated versions and applying upgrades reveals friction that contrasts with the smooth start.

In JavaScript ecosystems, pnpm outdated returns a compact table of packages that need updates. The output lists current version, latest allowed version, and the constraint defined in package.json.

uv lacks a dedicated outdated subcommand. Users must run uv tree --outdated --depth 1 which prints the entire top‑level dependency tree and marks only a few lines with update annotations.

When a project has fifty direct dependencies but only two need updates, the user still scans fifty lines. This forces extra cognitive load and makes the workflow feel slower than necessary.

Another point of contention is how uv records version constraints when adding a package. By default it writes pydantic>=2.13.4 with no upper bound, allowing any future major version to be pulled in during an upgrade.

pnpm and Poetry, by contrast, apply a caret or tilde range that stops at the next major release. This default behavior gives developers confidence that routine updates will not introduce breaking API changes, assuming maintainers follow semantic versioning.

Running uv lock --upgrade therefore becomes a risky operation. It upgrades every locked package to its absolute latest version, ignoring semantic safety and pulling in transitive dependencies that may have changed major versions.

To update only a few packages, the command repeats a flag for each target. For example, updating pydantic, httpx, and uvicorn requires uv lock --upgrade-package pydantic --upgrade-package httpx --upgrade-package uvicorn.

In pnpm the same action is pnpm update pydantic httpx uvicorn. Poetry offers poetry update pydantic httpx uvicorn.

A recent preview flag --bounds attempts to address the constraint issue. Using uv add pydantic --bounds major produces pydantic>=2.13.4,<3.0.0, mirroring the safety nets of other tools.

However, the flag remains opt‑in and is marked as preview, so developers must remember to include it each time. Until it becomes the default, teams either manually edit pyproject.toml or accept the risk of uncontrolled major version jumps.

The community would benefit from a dedicated uv outdated command that filters noise. An ergonomic update syntax that accepts a list of packages without repeating flags would also streamline routine work.

Despite these rough edges, uv’s speed and toolchain integration remain compelling. Many hope the UX will catch up to the performance, making uv a truly pleasant package manager for both new and established projects.