Repository navigation
chore(deps): update dependency astral-sh/uv to v0.12.23 - #780
Closed
Nikolaichukr wants to merge 1 commit into
Closed
Nikolaichukr wants to merge 1 commit into
Nikolaichukr wants to merge 1 commit into
Conversation
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Contributor
OPA/conftest tenant-isolation gateResult: passed
|
Contributor
Mutation test critical Lambda boundariesResult: passed
Coverage: 39.67% (1215/3063 lines) Lowest-covered Lambda files
|
Contributor
Offline IaC contract testsResult: passed
Coverage: 95.18% (1481/1556 lines) Lowest-covered Lambda files
|
Contributor
Automation gate testsResult: passed
Coverage: 88.30% (906/1026 lines) Lowest-covered Lambda files
|
Contributor
MiniStack smoke + real-handler execResult: passed
|
Contributor
Lambda unit testsResult: passed
Coverage: 92.76% (4641/5003 lines) Lowest-covered Lambda files
|
Contributor
OpenTofu module tests (latest-stable)Result: passed OpenTofu version:
|
Contributor
OpenTofu module tests (minimum-supported)Result: passed OpenTofu version:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.12.7→0.12.23Release Notes
astral-sh/uv
v0.12.23Compare Source
Released on 2026-10-03.
Python
Preview features
uv.lockwithout a workspace manifest usinguv sync --frozenwithfrozen-lockfile(#22018)uv.lockwithout a workspace manifest usinguv export --frozenwithfrozen-lockfile(#22007)uv.lockwithout a workspace manifest usinguv tree --frozenwithfrozen-lockfile(#22016)uv.lockwithout a workspace manifest usinguv workspace metadata --frozenwithfrozen-lockfile(#22017, #22018)Bug fixes
win_amd64wheels instead of building from source (#22099)v0.12.22Compare Source
Released on 2026-10-01.
Python
Enhancements
--offlineoption fromuv publishhelp (#22124)Preview features
--no-default-groupsinuv audit(#22090)uv auditoruv tool auditruns offline and hide the unsupported option from help (#22114)Configuration
UV_PYTHON_ARCHto select an interpreter architecture independently of its Python version (#22098)Performance
Bug fixes
Other changes
v0.12.21Compare Source
Released on 2026-09-29.
Python
Enhancements
[manifest]tables from lockfiles that contain only manifest subtables (#22070)Preview features
uv.lock, including those involving pre-releases, with theresolution-inputspreview feature (#22004, #22068)Bug fixes
uv python pin --rmfrom removing a global.python-versionsfile without--global(#21992)v0.12.20Compare Source
Released on 2026-09-28.
Enhancements
Preview features
lockfile-normalizationpreview feature (#21951)pylock.toml(#22003)pylock.tomlfiles relative to the output file (#22042)tool-install-locksrequirements resolve to the same package (#22000)lock-without-metadatalockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)uv workspace metadataanduv tree --format jsonoutput (#22050)Configuration
XDG_CONFIG_DIRSafter empty entries (#21987)Performance
Bug fixes
--require-hashesand--verify-hashes(#21996)--no-build(#21988)--all-packages, including--no-install-projectand--no-emit-project(#21994)pyproject.tomlifuv upgradefails or is interrupted (#21983)--show-settings(#21989)uv python listanduv python upgradeinstead of panicking (#22033)/install(#22036)v0.12.19Compare Source
Released on 2026-09-24.
Python
Enhancements
uv publisherrors (#21934)Preview features
build-lazy-importspreview feature (#21967)uv.lockand ignore changes to them when checking lockfile freshness with theresolution-inputspreview feature (#21913)Bug fixes
1.0.0as satisfying===1during installed-package checks, matching resolution (#21931).okfiles in dependencies (#21891)python_versionmarkers when parsing their serialized form (#21939)Rust API
FlatDistributionsexport and itsBTreeMapconversion for downstream resolvers (#21965)Documentation
v0.12.18Compare Source
Released on 2026-09-22.
This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.
Enhancements
--output-format jsontouv pip installanduv pip sync, including for--dry-runand--check(#21893)--checktouv pip installanduv pip syncto report planned changes without modifying the environment (#21844)get_requires_for_build_*hooks correctly in build errors (#21881)Preview features
uv build --no-build-isolationwith--preview-features build-dependency-check; use--skip-dependency-checkto opt out (#21880)Performance
uv_buildeditable wheel creation by omitting compression from temporary wheels (#21918)Bug fixes
uv add,uv remove, oruv versionfails or is interrupted (#21860, #21856)dependency-metadatawhen checking whether installed requirements are satisfied (#21843)?(#21920)v0.12.17Compare Source
Released on 2026-09-18.
Enhancements
Preview features
minimum-libc-version(#21651)pylock.tomlfiles whose wheel filenames do not match their declared package names or versions (#20746)uv workspace metadataread-only unless--syncis provided (#21821)uv checklock modes when retrieving workspace metadata (#21821)Performance
Bug fixes
required-environmentsfrom selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline (#21825)Documentation
v0.12.16Compare Source
Released on 2026-09-17.
Python
Enhancements
build-constraint-dependenciesentries to include hashes for verifying downloaded build dependencies (#21467)platform_releasemarkers inrequired-environmentsusing macOS wheel deployment targets (#21766)Preview features
lock-without-metadataacross all dependency types while retainingpackage.metadatafor remote URL dependencies to enable offline validation (#21163)uv upgrade(#21776)uv checkto run in projects that are not managed by uv and outside workspaces (#21777)--pythonandUV_PYTHONwhen selecting the Python version foruv check(#21744)Bug fixes
pylock.tomlbefore reusing cached distributions (#21609)uv_buildbackend only when its version matches active version pins (#21742)v0.12.15Compare Source
Released on 2026-09-15.
Performance
Bug fixes
0.12.14when installing to symlinked destinations or usinguv pip install --target .(#21699)v0.12.14Compare Source
Released on 2026-09-15.
Enhancements
cause:labels (#21599, #21603)uv tool upgradeoperations (#21566)Preview features
uv export --batchinvocation with thebatch-exportpreview feature (#21618)Performance
Bug fixes
required-environmentswithin each resolver fork instead of combining incompatible wheel coverage across forks (#21672)MAX_PATHon Windows systems without long-path support enabled (#21625)uv python installfrom overwriting valid unmanaged Python symlinks with relative targets on Unix (#21639)bin/pythonoverbin/python3when discovering interpreters in Unix environments (#21559)1for expected failures and2for recognized operational and internal failures (#17110)--quiet(#21565)uv tool upgradeerrors visible with-qwhile suppressing them with-qq(#21566)v0.12.13Compare Source
Released on 2026-09-10.
Python
Enhancements
Preview features
tyexclusions whenuv checkautomatically selects members of a virtual workspace (#21555)Performance
Bug fixes
core-metadataover legacy aliases in JSON index responses (#21563)v0.12.12Compare Source
Released on 2026-09-09.
The executables in our macOS and Windows release archives and
uvanduv_buildwheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.Bug fixes
exclude-newercutoff from lockfiles and generated requirement hashes (#21539)v0.12.11Compare Source
Released on 2026-09-08.
Preview features
pylock.tomlfiles to ensure they conform to PEP 751 (#20146)pylock.tomlartifact hash tables are empty, which will be rejected in a future uv release (#21462)Performance
uv pip install --no-depsfinds the requested packages already installed (#21523)Bug fixes
uv.lockbefore reading their metadata or running their build backends (#21223)===under both--verify-hashesand--require-hashes(#21543).python-versionand.python-versionsfiles (#21529)VIRTUAL_ENVmismatch warnings foruv add --no-sync,uv remove --no-sync, anduv add --frozen(#21496)uv python listcannot query an interpreter (#21498)Documentation
exclude-newerexamples (#21534)v0.12.10Compare Source
Released on 2026-09-04.
Enhancements
uv publishcompletes, including when publishing fails (#21423)Preview features
exclude-newer-packagesettings for packages outside the resolution fromuv.lockwith themissing-exclude-newer-package-lockpreview feature (#21455)uv tree --invertoutput (#21404)Performance
uv publishby hashing each artifact in a single blocking task and reusing the buffer across reads (#21389)Bug fixes
--lockedfrom failing whenexclude-newer-packagesettings differ only for packages outside the resolution (#21454)uv lock --checkto reuse a lockfile when an absoluteexclude-newercutoff is moved later (#19571)uv lock --checkto reuse a lockfile when a package-specificexclude-newercutoff is disabled (#21450)--namewhenuv initwould infer a project name reserved for a Python interpreter (#21395)exclude-newercutoffs touv.lockin a deterministic order (#21453)v0.12.9Compare Source
Released on 2026-09-01.
Python
Enhancements
--no-lockedand--no-frozento disable lock modes enabled byUV_LOCKEDandUV_FROZENfor a single invocation (#21408)Performance
Bug fixes
async_http_range_readerto 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)--locked,--frozen,--check, and--check-existsprecedence over conflictingUV_LOCKEDandUV_FROZENvalues (#21396)v0.12.8Compare Source
Released on 2026-08-31.
Enhancements
uv tool upgrade --all(#21368)Preview features
content-addressed-cachepreview feature (#21327)Performance
Bug fixes
--require-hashes(#21348)sig) query parameters from displayed URLs (#21360)Other changes
astral-tokio-tarto 0.7.0 and use effective sizes when tracking extracted hard links (#21346)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.