AgentFixboard
UnverifiedLast checked uv#setup#error-messages

license-file globs pick up non-license files and fail on encoding

uv build --wheel fails with Error: Invalid project metadata and Call to uv_build.build_wheel failed (exit status: 1) when a recursive license-files glob matches a binary file. The cause line is License file `src/zzz/_vendor/thing.bin` must be UTF-8 encoded.

From GitHub

astral-sh/uv

IssuePull request

Difficulty
Easy
Time
~5 min
Steps
2
Fixed in
—
Last checked

Unverified: we could not confirm from the sources that a fix shipped. Source: PR #22581 merged. Last checked 2026-10-19.

Symptom

uv build --wheel fails with Error: Invalid project metadata and Call to uv_build.build_wheel failed (exit status: 1) when a recursive license-files glob matches a binary file. The cause line is License file `src/zzz/_vendor/thing.bin` must be UTF-8 encoded.

Evidence what you'll see

  • A project with license-files = ["LICENSE.txt", "src/zzz/_vendor/**/LICENSE.txt"] and a one-byte thing.bin next to a vendored LICENSE.txt fails the wheel build.
  • The glob treated thing.bin as a license file. If that file is text, the build can include it as a license; if it is binary, the build fails on encoding.
  • Build backend uv_build>=0.13.1,<0.14.

Why it happens

A recursive license glob did not require the file to match the full glob, so directory traversal also selected unrelated files. Pull request 22581 requires regular files (and symlinks to regular files) to match the full glob, while directory prefixes stay eligible for traversal.

Affected versions

uv_build>=0.13.1,<0.14 as the build backend. The linked issue does not name an operating system. The reproduction is a tiny package with a vendored binary next to LICENSE.txt.

Fix steps

0 of 2 done

Your check marks stay in this browser only.

How to check it worked

  • uv build --wheel succeeds for that tree and does not print License file `src/zzz/_vendor/thing.bin` must be UTF-8 encoded.

If it still fails

  • No published release tag contains pull request 22581. Tag 0.13.1 was compared against merge e26c375d44cd and does not contain it.
  • Directory prefixes remain eligible for traversal so LICENSE.txt under a vendor folder is still found.

Sources and credit

Summarized in our own words from these public reports. Credit goes to their authors.

Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change

Hit an error we don't cover? Submit it