Notify users when a new Python patch version is available

[itamarst]

I'm running on 3.12.7. CPython releases 3.12.8 with security fixes. It would be good for uv to notify users that they want to install this new version.

Compare to Linux distribution behavior, where there's an auto-update mechanism that might (depending on distro) pop up saying "updates available, click here to install".

(See also #1795 (comment) for some motivation re making existing venvs secure.)

[zanieb]

Good idea :)

[s-banach]

Sorry to bother you both, hopefully this question is on-topic.
Is it possible to update the python version in an existing venv without destroying the venv?
Thanks.

[zanieb]

Only to a different patch version of the same minor version — and it's sort of a workaround e.g.

❯ uv venv -p 3.11
Using CPython 3.11.10
Creating virtual environment at: .venv
Activate with: source .venv/bin/activate
❯ uv pip install anyio
Resolved 3 packages in 118ms
Installed 3 packages in 5ms
 + anyio==4.6.2.post1
 + idna==3.10
 + sniffio==1.3.1
❯ ls .venv/lib/python3.11/site-packages
__pycache__			_virtualenv.py			anyio-4.6.2.post1.dist-info	idna-3.10.dist-info		sniffio-1.3.1.dist-info
_virtualenv.pth			anyio				idna				sniffio
❯ uv venv -p 3.11.5 --allow-existing
Using CPython 3.11.5
Creating virtual environment at: .venv
Activate with: source .venv/bin/activate
❯ ls .venv/lib/python3.11/site-packages
__pycache__			_virtualenv.py			anyio-4.6.2.post1.dist-info	idna-3.10.dist-info		sniffio-1.3.1.dist-info
_virtualenv.pth			anyio				idna				sniffio
❯ .venv/bin/python --version
Python 3.11.5

Switching minor versions can change the package compatibility and is generally not safe.

[janosh]

and it's sort of a workaround

very useful! 👍 would be great to document this workaround and maybe add a test for it to ensure it doesn't break