uv trims cold install times up to 9.5% by reusing hashing buffers during wheel extraction

A performance patch in uv, Astral's Python package installer, removes a small but repeated cost during wheel installation: instead of allocating a fresh buffer for every file it hashes while unpacking an archive, uv now reuses a single buffer across the entire wheel. According to the pull request filed on uv's GitHub repository by Charlie Marsh, that change reduces hashing buffer allocations for a benchmark PyTorch wheel from 11,120 to one, and it cut cold-install times by roughly 7 to 9.5 percent in the author's measurements. The work surfaced on the Hacker News front page feed.

What changed

When content hashing is enabled — the mode behind uv's content-addressed caching — uv streams a wheel during extraction, writes each file out, and hashes the bytes as they pass through. The previous implementation created and zeroed a new 64 KiB buffer for every file processed, so wheels built from thousands of small files paid constant allocation and zeroing overhead purely to feed the hasher.

The patch keeps one buffer alive for the duration of a wheel's extraction and reuses it file after file. According to the PR, the buffer size remains 64 KiB per active wheel, so the change adds no meaningful memory cost — only the number of allocations falls. Because the savings scale with file count, packages with many bundled files, such as PyTorch, benefit most.

Benchmark numbers

The measurements were taken on Linux, alternating base and candidate runs, using pinned wheels served over local HTTP with content-addressed caching enabled. Cold install results:

Scenario	Before	After	Change
AnyIO	110 ms	107 ms	-2.6%
SymPy	845 ms	775 ms	-8.3%
NumPy	627 ms	567 ms	-9.5%
PyTorch CPU	6.50 s	5.99 s	-7.8%
14-package environment, concurrency 4	6.95 s	6.47 s	-7.0%

The individual package results used 16 paired rounds, while the full 14-package environment used 12. AnyIO, SymPy and NumPy were re-run after an initial 20-pair pass because the first AnyIO timings were noisy; the PR notes the initial SymPy and NumPy improvements were 7.8 and 6.9 percent respectively. Across the initial runs, repeats and controls, 672 installs were measured, excluding warmups and cache priming.

Caveats

The comparison baseline is not uv's main branch. The PR states the numbers compare the deduplication work at commit a188b8e with the buffer-reuse optimization applied on top, before the change was moved onto main, so the final gains against main may differ. Cached installs and local-wheel control runs showed no consistent change, which fits the fact that the optimization targets the extraction-and-hashing path that only cold installs exercise.

Why it matters

Speed is uv's core selling point over pip and other Python tooling, and content-addressed caching is what lets uv verify integrity and share identical files across environments. That safety has a CPU price: every byte of every installed wheel gets hashed. A change that makes the hashing loop nearly allocation-free removes much of that trade-off without altering behavior or adding memory pressure.

The gains also land where Python installs hurt most. Large scientific and ML packages like PyTorch and NumPy are exactly the ones with thousands of files, and they showed the largest improvements — 7.8 and 9.5 percent on cold installs in these benchmarks. For continuous integration pipelines and container builds, where caches are often empty and full environments are installed from scratch, those percentages compound across every run.

Finally, the PR is a model of careful benchmarking for a small change: paired alternating runs, repeated measurements after detecting noise, control scenarios to confirm where the effect should and should not appear, and full disclosure of the baseline commit. That transparency makes the headline numbers easier to trust.