Skip to content

chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.10 - #302

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-astral-sh-uv-0.x
Open

chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.10#302
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-astral-sh-uv-0.x

Conversation

@renovate

@renovate renovate Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
ghcr.io/astral-sh/uv stage patch 0.12.5 → 0.12.10

Release Notes

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.12.10

Compare Source

Released on 2026-09-04.

Enhancements
  • Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#​21423)
Preview features
  • Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#​21455)
  • Show terminal dependency cycles in uv tree --invert output (#​21404)
Performance
  • Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#​21399)
  • Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#​21389)
Bug fixes
  • Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#​21454)
  • Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#​19571)
  • Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#​21450)
  • Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#​21395)
  • Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#​21453)

v0.12.9

Compare Source

Released on 2026-09-01.

Python
Enhancements
  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#​21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#​21402)
Performance
  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#​21372)
Bug fixes
  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#​21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#​21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#​21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#​21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#​21400)

v0.12.8

Compare Source

Released on 2026-08-31.

Enhancements
  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#​21368)
Preview features
  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#​21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#​21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#​21344)
Performance
  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#​21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#​21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#​21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#​21300)
Bug fixes
  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#​21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#​21366)
  • Redact Azure shared access signature (sig) query parameters from displayed URLs (#​21360)
  • Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#​21341)
Other changes
  • Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#​21346)

v0.12.7

Compare Source

Released on 2026-08-27.

Python
  • Replace managed Python installations when upgrading to a newer build of the same version (#​21323)
Enhancements
  • Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#​21313)
  • Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#​21318)
Preview features
  • Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#​19693)
Bug fixes
  • Reject source archives with hash mismatches before persisting their extracted contents to the cache (#​21248)
Other changes

v0.12.6

Compare Source

Released on 2026-08-25.

Python
  • Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #​21295)
Enhancements
  • Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#​21261)
  • Limit warnings about unbounded uv_build requirements to source-distribution builds (#​21078)
  • Display byte counts below 1 KiB without a fractional part (#​21237)
Preview features
  • Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#​21117)
  • Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#​21235)
  • Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#​21227)
  • Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#​21146)
Performance
  • Enable profile-guided optimization for Linux x86-64 release binaries (#​21001)
  • Enable profile-guided optimization for Windows x86-64 release binaries (#​21003)
  • Enable profile-guided optimization for macOS ARM64 release binaries (#​21002)
  • Enable profile-guided optimization for Linux ARM64 release binaries (#​21004)
  • Speed up syncing projects with many activated conflict items by reusing their encoded representation (#​21148)
Bug fixes
  • Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#​21294)
  • Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#​21275)
  • Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#​21224)
  • Prevent TLS segfaults in riscv64 musl release binaries (#​21158)
  • Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#​21181)
  • Preserve version constraints from transitively referenced recursive extras (#​21209)
  • Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#​21264)
  • Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#​21282)
  • Do not misclassify package URLs ending in .py as local script paths (#​21144)
  • Use directory creation times consistently across libc implementations for directory cache-keys entries (#​21137)
  • Promote human-readable sizes to the next unit at rounding boundaries (#​21136)
Other changes
  • Add Python 3.15 release-candidate Docker images (#​21293)
  • Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#​21258)

Configuration

📅 Schedule: (in timezone US/Eastern)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) August 31, 2026 11:32
feoh added a commit that referenced this pull request Aug 31, 2026
@feoh
chore(witan-core): pin omnigraph to the released v0.10.0, off the `ed…
425a466 
…ge` tag

`edge` is force-updated on every push to upstream main, so a pinned digest
describes a tarball that stops being downloadable the moment upstream
merges. It broke twice on 2026-08-31 alone: `witan-code (code graph)` — the
one job deliberately left uncached to report exactly this — was red on #300
and #302 at 11:32Z, went green when #305 refreshed the pin at 14:44Z, and
was red again on #308/#309 by 20:13Z after four upstream pushes republished
the assets. The refresh held about six hours. A fresh `witan setup` fails
the same way, for the same reason.

Upstream cut v0.10.0 at 21:29Z tagging a625748c8b, which is the same commit
the then-current `edge` build came from, so this pins the same source under
a name that cannot move rather than adopting a new one. That also ends the
"temporarily on edge for a re-test" note above the version pin: the build
under test now has a release.

Four upstream commits arrive relative to the pinned ac620eea87. Only one
carries operator consequence: #581 upgrades Lance to 11, which upstream
says changes English stemming, so an index built by Lance 10 read with the
Lance 11 analyzer silently under-returns. Every search()/bm25() query in
read.gq sits on such an index. _OMNIGRAPH_INTERNAL_SCHEMA stays 6 and the
storage-format gate stays green, so nothing catches this automatically —
existing graphs need an explicit, per-branch
`omnigraph rebuild-full-text-indexes`. Recorded in full above the digests.

Verified against the v0.10.0 binary: witan-core 584, witan-council 1009,
witan-code 580 — 2173 passed, no failures. The history block records how to
run that honestly, since hermetic.py prepends the real ~/.local/bin and a
PATH override alone silently tests the machine's existing binary instead.
@feoh feoh mentioned this pull request Aug 31, 2026
Merged
1 task
blarghmatey pushed a commit that referenced this pull request Aug 31, 2026
@feoh
chore(witan-core): pin omnigraph to the released v0.10.0, off the `ed…
2727f12 
…ge` tag (#311)

* chore(witan-core): pin omnigraph to the released v0.10.0, off the `edge` tag

`edge` is force-updated on every push to upstream main, so a pinned digest
describes a tarball that stops being downloadable the moment upstream
merges. It broke twice on 2026-08-31 alone: `witan-code (code graph)` — the
one job deliberately left uncached to report exactly this — was red on #300
and #302 at 11:32Z, went green when #305 refreshed the pin at 14:44Z, and
was red again on #308/#309 by 20:13Z after four upstream pushes republished
the assets. The refresh held about six hours. A fresh `witan setup` fails
the same way, for the same reason.

Upstream cut v0.10.0 at 21:29Z tagging a625748c8b, which is the same commit
the then-current `edge` build came from, so this pins the same source under
a name that cannot move rather than adopting a new one. That also ends the
"temporarily on edge for a re-test" note above the version pin: the build
under test now has a release.

Four upstream commits arrive relative to the pinned ac620eea87. Only one
carries operator consequence: #581 upgrades Lance to 11, which upstream
says changes English stemming, so an index built by Lance 10 read with the
Lance 11 analyzer silently under-returns. Every search()/bm25() query in
read.gq sits on such an index. _OMNIGRAPH_INTERNAL_SCHEMA stays 6 and the
storage-format gate stays green, so nothing catches this automatically —
existing graphs need an explicit, per-branch
`omnigraph rebuild-full-text-indexes`. Recorded in full above the digests.

Verified against the v0.10.0 binary: witan-core 584, witan-council 1009,
witan-code 580 — 2173 passed, no failures. The history block records how to
run that honestly, since hermetic.py prepends the real ~/.local/bin and a
PATH override alone silently tests the machine's existing binary instead.

* chore(witan-core): record the FTS-rebuild task slug in the pin history

* fix(witan-core): classify omnigraph 0.10.0's full-text rebuild 409 as terminal

Copilot review on #311, and it corrects the premise of the pin commit.

omnigraph 0.10.0 does not ship raw Lance 11's silent under-return. Upstream
#581 added a guard: an index whose analyzer generation cannot be proven
compatible raises FullTextIndexRebuildRequired — HTTP 409 with a
`full_text_index_rebuild_required` detail — and their doc comment is
explicit that ordinary reads stay available and a partial indexed result is
never returned. So search fails closed rather than degrading quietly. The
history block said the opposite and is corrected.

That makes the client the problem. `classify_status` treats a bare 409 as
RETRYABLE on the status alone — deliberately, so a lost CAS race is
legible — and nothing above it matched this message. Every refused
search()/bm25() would therefore be retried the full budget and surface as a
timeout-shaped error, hiding the remedy the server already printed.

Adds FULL_TEXT_REBUILD_REQUIRED, classified ahead of the 409 catch-all on
the structured detail key and on the server's own prose, terminal on the
first attempt on both transports. Not NEEDS_REPAIR: the graph is not
damaged and `omnigraph repair --force` would be the wrong hammer.

Regression tests cover both transports, that the detail key alone suffices,
and that an ordinary lost-race 409 is still RETRYABLE. All four fail
without the classification.

witan-core 588, witan-council 1009, witan-code 580 — 2177 passed against
the v0.10.0 binary.
@renovate renovate Bot changed the title chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.7 chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.7 - autoclosed Sep 2, 2026
@renovate renovate Bot closed this Sep 2, 2026
auto-merge was automatically disabled September 2, 2026 17:57

Pull request was closed

@renovate
renovate Bot deleted the renovate/ghcr.io-astral-sh-uv-0.x branch September 2, 2026 17:57
@renovate renovate Bot changed the title chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.7 - autoclosed chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.10 Sep 6, 2026
@renovate renovate Bot reopened this Sep 6, 2026
@renovate
renovate Bot force-pushed the renovate/ghcr.io-astral-sh-uv-0.x branch 2 times, most recently from 0e8cf18 to faad09f Compare September 6, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants