conda-lock vs uv

conda-lock is a lightweight library for producing reproducible lockfiles for conda environments. It solves dependencies separately for each target platform, allowing installations from generated lockfiles to avoid running the conda solver. Inputs can come from environment.yml, conda-build meta.yaml, or pyproject.toml dependency specifications. Its default unified lockfile covers multiple platforms and can be rendered into other lockfile formats. Documented target examples include Linux, macOS, Windows, and additional Linux architectures. The project describes use alongside conda, mamba, pip, Docker, and pixi, and provides installation routes through pip, conda, and mamba; pipx or condax are recommended for isolated installation. Mixed conda-and-pip locking is experimental. Channel access supports token or basic authentication, with environment-variable substitution for credentials. The unified lockfile can omit raw credential-bearing channel URLs when it matches credential portions to environment variables, although rendered explicit lockfiles may contain substituted variables. Private pip repository support is limited to legacy PyPI repositories using basic authentication. The software is MIT-licensed and free.

uv is a Python package and project manager for Linux, macOS, and Windows. Written in Rust, it manages dependencies and environments, with lockfiles and workspaces, and can install, list, pin, or uninstall Python versions. It also runs scripts with dependencies and runs or installs command-line tools from Python packages. Its pip-compatible interface is intended to cover work done by tools such as pip, pip-tools, pipx, poetry, pyenv, twine, and virtualenv, though its commands do not exactly match those tools. The documentation describes uv as 10–100x faster than pip. It supports source distributions, wheels, requirements.txt, and pylock.toml, as well as offline installation and private registry authentication. For package selection, its default first-index strategy limits candidates to the first index where a package is found. Credentials are not stored in uv.lock, but uv currently stores them in a plaintext file; native system secret storage is an experimental preview. The free plan is free.