You run uv pip install dozens of times a day. You run ruff check on every save. These are Python developer tools — uv handles packages (downloading and installing the libraries your code needs), Ruff catches code mistakes before they blow up in production. Fast, free, and they don't care who signs your paycheck. That's the beauty of independent open-source software — code anyone can use, inspect, and modify.

That independence now has an expiration date.

OpenAI Buys Your Toolchain

On March 19, OpenAI announced it's acquiring Astral, the company behind uv (126 million monthly downloads), Ruff, and the emerging type checker ty. Charlie Marsh, Astral's founder, said he wanted to chase "the frontier of AI and software." The entire team joins OpenAI's Codex division — Codex being their coding agent (an AI that writes and runs code on its own), now at 2 million weekly users with 5x usage growth this year.

The blog post hits every predictable note: everything stays open source, MIT license (a permissive license that lets anyone use the code for anything) stays unchanged, same level of care and attention. Douglas Creager from Astral reassured Hacker News that nothing changes. If you've watched corporate acquisitions before, you know "nothing changes" is corporate for "everything changes, slowly."

Why Would an AI Lab Buy a Linter?

An AI company buying a linter (a tool that checks code for errors) and a package manager (a tool that installs libraries) sounds like a plumber buying a bakery. But it makes perfect sense once you see what Codex actually does.

Codex is a coding agent. Agents don't just write code — they resolve dependencies, manage environments, run quality checks. Right now, Codex bolts these capabilities on through external tools. With uv and Ruff owned in-house, OpenAI wires dependency resolution and linting directly into Codex's core. Not through adapters. Not through plugins. Natively.

We've seen this exact pattern. Microsoft bought GitHub and got Copilot's training data pipeline. npm gave them the JavaScript dependency graph (the map of which packages rely on which other packages). Now uv and Ruff hand OpenAI the entire Python development lifecycle — from install to lint to type-check — plumbed straight into their agent. Simon Willison flagged the risk directly: "One bad version of this deal would be if OpenAI start using their ownership of uv as leverage in their competition with Anthropic."

Both announcement posts skip one thing entirely: pyx, Astral's private PyPI registry (a place companies store their proprietary Python packages) announced in August 2025. A paid product, quietly absent from the conversation. Draw your own conclusions.

The Fork Illusion

The common rebuttal: it's MIT-licensed, just fork it — copy the entire codebase and maintain it independently. Armin Ronacher, creator of Flask, pointed out that forking is easy in the worst case. Clicking the fork button is trivial. But as one Lobsters commenter noted: "Actually picking up the mantle, finding funding, assembling a new team capable of making quality contributions to the code, is much much harder." These are complex Rust codebases. Forks without institutional backing tend to wither and die.

And Anthropic already ran the same play — acquiring Bun (a JavaScript runtime, the engine that actually executes JS code) in December 2025, shipping it as a binary inside Claude Code. Same promises, same structure. The AI labs aren't buying tools. They're buying developer dependency graphs.

Your CI Now Reports to OpenAI

If your CI pipeline (the automated system that builds, tests, and deploys your code) runs uv and ruff, your local dev uses uv venv, and your editor runs Ruff on every save — you now depend on OpenAI whether you chose to or not. JetBrains pledged to keep integrating with whoever maintains these tools. That's diplomatic for "we're watching too."

The tools work today. They'll probably work fine tomorrow. The question nobody at OpenAI will answer honestly: will uv and Ruff serve Python developers or Codex retention metrics in 18 months? Every corporate open-source acquisition starts with "nothing changes." Oracle and MySQL. IBM and Red Hat. Broadcom and VMware. The script writes itself — only the timeline varies.

You used to install packages from an independent project. Now you install them from OpenAI. Nothing changed, of course.