Astral has introduced tar-codec, the Rust library used to process source distributions starting with uv 0.13. Its redesigned parser aims to reduce cases where inspection and installation tools extract different contents from the same archive, with the company reporting roughly twice the speed of its previous implementation. An earlier parser issue in a related advisory was already fixed in uv 0.9.5 and is distinct from this release. Source distributions can execute code during installation by design, so the new parser does not make an untrusted package safe.