uvault
Development and vaulting workflow for uv VCS dependencies.
Secure your Python projects against deleted or force-pushed upstream commits. uvault automatically vaults transient VCS references (like GitHub PRs) into your organization's own repositories, while allowing developers to instantly switch dependencies into local editable mode—fully integrated with pyproject.toml and uv.
Key Features
- Vaulting of Commits: Never lose code again! Upstream pull requests and branches can be force-pushed or deleted.
uvaultfetches the exact commits your project depends on and pushes them as immutable tags to your own organization's vault repository. - Easy Local Development: Switch any VCS dependency to local "editable" mode in seconds.
uvault developclones the package locally and seamlessly configuresuvto use your local copy so you can test changes and contribute back. - Automatic GitHub Forking: When a dependency's repository doesn't exist in your vault organization,
uvaultautomatically forks the upstream repository using the GitHub API (via the[github]extra), making the setup completely transparent. - Status Monitoring: Instantly check the health of all your VCS dependencies.
uvault statusshows if PRs are merged or closed, flags new remote commits, and automatically detects orphaned commits caused by upstream force-pushes.
Documentation
The complete documentation is available in the docs/ folder:
- Quickstart & Key Features - Learn what
uvaultis and how to get started quickly. - How-To Guides - Step-by-step guides for installing and using
uvaultin your day-to-day workflow. - CLI & Configuration Reference - Detailed information on
pyproject.tomlconfiguration ([tool.uvault]) and all CLI commands (sync,add,develop).
Contributing
Contributions are welcome! If you're interested in improving uvault, please check out our Contributing Guide for details on setting up your development environment, running tests, and submitting PRs.
Credits & Acknowledgements
A huge thank you to Stéphane Bidoul for his continuous inspiration, and particularly for the work on pip-preserve-requirements which strongly influenced the vision and design of this project.
1 maintainer
Metadata
1 maintainer
Release files for uvault 0.8.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| uvault-0.8.0.tar.gz | 130.1 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| uvault-0.8.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 153.9 kB
Release files / uvault-0.8.0.tar.gz
| Download URL | uvault-0.8.0.tar.gz |
|---|---|
| Size | 130.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ed22ab9a2a22d5219d2949e37c139be8bcb78fdd4fc4052c0fdc7cfac9bd122d
|
|
BLAKE2b-256 checksum How to use checksums |
b92d16c288e727122252f611997664240fdb9fbd29ae0aa035ba777cb7d8f9f5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logRelease files / uvault-0.8.0-py3-none-any.whl
| Download URL | uvault-0.8.0-py3-none-any.whl |
|---|---|
| Size | 23.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
fecbc9c8373c9cfb7fcee401e7e0d3a4a32d5527b8844823927200f2f59854c0
|
|
BLAKE2b-256 checksum How to use checksums |
bef2e23764ba249cc1c2f0412b0a8c69fc1474cec8e2e06a9eff3fc8d1e8a523
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logSecurity for uvault 0.8.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for uvault-0.8.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
