Skip to content

chore(deps): update uv - #98

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/uv
Open

chore(deps): update uv#98
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/uv

Conversation

@renovate

@renovate renovate Bot commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
astral-sh/setup-uv action minor v10.0.1 → v10.2.0 age confidence
astral-sh/uv uses-with patch 0.12.10 → 0.12.21 0.12.23 (+1) age confidence
astral-sh/uv-pre-commit repository patch 0.12.10 → 0.12.21 0.12.23 (+1) age confidence
uv (source, changelog) patch 0.12.10 → 0.12.21 0.12.23 (+1) age confidence

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

astral-sh/uv (astral-sh/uv)

v0.12.21

Compare Source

Released on 2026-09-29.

Python
  • Update CPython to use OpenSSL 3.5.9 (#​22076)
Enhancements
  • Omit empty [manifest] tables from lockfiles that contain only manifest subtables (#​22070)
Preview features
  • Omit redundant runtime constraints from uv.lock, including those involving pre-releases, with the resolution-inputs preview feature (#​22004, #​22068)
Bug fixes
  • Prevent uv python pin --rm from removing a global .python-versions file without --global (#​21992)
  • Fix installed-package checks incorrectly reporting post-releases as incompatible with exclusive lower bounds on pre-releases (#​22049)

v0.12.20

Compare Source

Released on 2026-09-28.

Enhancements
  • Reuse lockfiles when dependency declarations are semantically equivalent (#​21951)
  • Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#​21990)
Preview features
  • Write normalized requirement declarations with the lockfile-normalization preview feature (#​21951)
  • Honor synthetic default groups when installing or syncing from pylock.toml (#​22003)
  • Resolve local paths in exported pylock.toml files relative to the output file (#​22042)
  • Install each package only once when repeated tool-install-locks requirements resolve to the same package (#​22000)
  • Reuse lock-without-metadata lockfiles for conflicting groups with distinct base and extra requirement specifiers (#​22055)
  • Use consistent root-package paths in uv workspace metadata and uv tree --format json output (#​22050)
Configuration
  • Continue searching XDG_CONFIG_DIRS after empty entries (#​21987)
Performance
  • Restore the previous HTTP cache-write scheduling while investigating severe cache-revalidation stalls on ext4 filesystems (#​22051)
Bug fixes
  • Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#​21996)
  • Allow metadata builds for first-party workspace projects under --no-build (#​21988)
  • Honor project exclusion flags with --all-packages, including --no-install-project and --no-emit-project (#​21994)
  • Restore pyproject.toml if uv upgrade fails or is interrupted (#​21983)
  • Generate working Nushell activation scripts for relocatable virtual environments (#​21979)
  • Prevent commands from running and changing state after displaying --show-settings (#​21989)
  • Treat UTF-16 requirements files containing only a byte-order mark as empty (#​21991)
  • Ignore unrecognized managed-Python implementation directories during uv python list and uv python upgrade instead of panicking (#​22033)
  • Avoid panics and incorrect rewriting when managed Python sysconfig paths merely start with /install (#​22036)
  • Report whitespace-only non-ASCII requirements as invalid instead of panicking (#​22035)
  • Avoid a resolver panic when trace logging an always-false constraint (#​22034)

v0.12.19

Compare Source

Released on 2026-09-24.

Python
  • Add PyPy 3.11.16 and 3.12.14 (#​21847)
  • Update GraalPy 3.13.0 to build 25.4.4 (#​21847)
Enhancements
  • Format upload URLs with backticks in uv publish errors (#​21934)
Preview features
  • Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#​21967)
  • Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#​21913)
Bug fixes
  • Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#​21971)
  • Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#​21931)
  • Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#​21891)
  • Preserve always-false python_version markers when parsing their serialized form (#​21939)
Rust API
  • Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#​21965)
Documentation
  • Make individual preview-feature reference entries linkable by name (#​21950)

v0.12.18

Compare Source

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements
  • Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#​21893)
  • Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#​21844)
  • Identify failures from get_requires_for_build_* hooks correctly in build errors (#​21881)
Preview features
  • Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#​21880)
Performance
  • Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#​21918)
Bug fixes
  • Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#​21835, #​21836)
  • Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#​21860, #​21856)
  • Use configured dependency-metadata when checking whether installed requirements are satisfied (#​21843)
  • Reject archive entries that normalize to absolute Windows paths (#​21923)
  • Recognize distribution filenames and archive extensions when URL fragments contain ? (#​21920)
  • Generate correctly lowercased platform tags for BSD and Haiku releases (#​21853)
  • Avoid rebuilding a Windows relative path into an absolute form (#​21923)

v0.12.17

Compare Source

Released on 2026-09-18.

Enhancements
  • Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#​21780)
Preview features
  • Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#​21651)
  • Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#​20746)
  • Keep uv workspace metadata read-only unless --sync is provided (#​21821)
  • Apply uv check lock modes when retrieving workspace metadata (#​21821)
Performance
  • Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#​21650)
  • Reduce resolver allocations when deduplicating package and distribution requests (#​21810)
Bug fixes
  • Prevent required-environments from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline (#​21825)
Documentation
  • Clarify the 0.12.14 and 0.12.15 release notes (#​21817)

v0.12.16

Compare Source

Released on 2026-09-17.

Python
  • Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#​21741)
Enhancements
  • Verify downloaded wheels and source distributions against hashes supplied by package indexes (#​21562)
  • Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#​21467)
  • Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#​21766)
  • Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#​21779)
Preview features
  • Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#​21163)
  • Honor configured and command-line index settings, including credentials, in uv upgrade (#​21776)
  • Allow uv check to run in projects that are not managed by uv and outside workspaces (#​21777)
  • Respect --python and UV_PYTHON when selecting the Python version for uv check (#​21744)
Bug fixes
  • Redact Azure shared access signatures from displayed and logged URLs (#​21755)
  • Check archive sizes from pylock.toml before reusing cached distributions (#​21609)
  • Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#​20631)
  • Use the bundled uv_build backend only when its version matches active version pins (#​21742)
  • Handle malformed index URLs without panicking when credentials are configured (#​21784)
  • Report a configuration error instead of panicking for proxy URLs without a host (#​21781)
  • Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#​21783)

v0.12.15

Compare Source

Released on 2026-09-15.

Performance
  • Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#​21675)
Bug fixes
  • Fix regressions in 0.12.14 when installing to symlinked destinations or using uv pip install --target . (#​21699)

v0.12.14

Compare Source

Released on 2026-09-15.

Enhancements
  • Resume interrupted downloads with HTTP Range requests when supported (#​21570)
  • Use a consistent format for error rendering (#​17110)
  • Render error and warning causes with compact cause: labels (#​21599, #​21603)
  • Show underlying causes and hints in user warnings (#​21565)
  • Show resolver hints for failed uv tool upgrade operations (#​21566)
Preview features
  • Export multiple dependency selections from a shared lockfile in one uv export --batch invocation with the batch-export preview feature (#​21618)
Performance
  • Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task (#​21619)
  • Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers (#​21593)
  • Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task (#​21621)
Bug fixes
  • Select releases that satisfy required-environments within each resolver fork instead of combining incompatible wheel coverage across forks (#​21672)
  • Install packages with paths longer than MAX_PATH on Windows systems without long-path support enabled (#​21625)
  • Prevent uv python install from overwriting valid unmanaged Python symlinks with relative targets on Unix (#​21639)
  • Redact credentials and signatures from missing-path-segment URL errors (#​21616)
  • Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation (#​21640)
  • Prefer bin/python over bin/python3 when discovering interpreters in Unix environments (#​21559)
  • Classify package-operation exit codes by their underlying cause: return 1 for expected failures and 2 for recognized operational and internal failures (#​17110)
  • Suppress managed-Python fallback warnings under --quiet (#​21565)
  • Keep failed uv tool upgrade errors visible with -q while suppressing them with -qq (#​21566)

v0.12.13

Compare Source

Released on 2026-09-10.

Python
Enhancements
  • Verify hashes when downloading PEP 658 metadata sidecars (#​21563)
Preview features
  • Respect ty exclusions when uv check automatically selects members of a virtual workspace (#​21555)
Performance
  • Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#​21279)
Bug fixes
  • Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#​18713)
  • Prefer core-metadata over legacy aliases in JSON index responses (#​21563)

v0.12.12

Compare Source

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes
  • Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#​21539)

v0.12.11

Compare Source

Released on 2026-09-08.

Preview features
  • Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#​20146)
  • Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#​21462)
Performance
  • Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#​21478)
  • Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#​21468)
  • Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#​21500)
  • Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#​21499)
  • Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#​21523)
Bug fixes
  • Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#​21223)
  • Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#​21543)
  • Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#​21544)
  • Support PowerShell virtual environment activation from UNC paths, including WSL paths (#​19159)
  • Trim surrounding whitespace from entries in .python-version and .python-versions files (#​21529)
  • Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#​21496)
  • Warn and continue when uv python list cannot query an interpreter (#​21498)
Documentation
  • Restore TOML syntax highlighting for exclude-newer examples (#​21534)
astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)

v0.12.21

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.21

v0.12.20

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.20

v0.12.19

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.19

v0.12.18

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.18

v0.12.17

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.17

v0.12.16

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.16

v0.12.15

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.15

v0.12.14

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.14

v0.12.13

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.13

v0.12.12

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.12

v0.12.11

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.11

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/uv branch 6 times, most recently from f43c83b to 078b73b Compare September 28, 2026 22:15
@renovate
renovate Bot force-pushed the renovate/uv branch 4 times, most recently from 1acb529 to aa5c051 Compare October 7, 2026 00:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@mschoettle mschoettle

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mschoettle