Bump uv from 0.12.10 to 0.12.18

[dependabot]

Bumps uv from 0.12.10 to 0.12.18.

Release notes

Sourced from uv's releases.

0.12.18

Release Notes

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

• Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

• Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
• Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
• Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
• Reject archive entries that normalize to absolute Windows paths (#21923)
• Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
• Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
• Avoid rebuilding a Windows relative path into an absolute form (#21923)

Install uv 0.12.18

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex"

Download uv 0.12.18

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

• Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

• Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
• Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
• Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
• Reject archive entries that normalize to absolute Windows paths (#21923)
• Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
• Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
• Avoid rebuilding a Windows relative path into an absolute form (#21923)

0.12.17

Released on 2026-09-18.

Enhancements

• Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#21780)

Preview features

• Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#21651)
• Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#20746)
• Keep uv workspace metadata read-only unless --sync is provided (#21821)
• Apply uv check lock modes when retrieving workspace metadata (#21821)

Performance

• Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#21650)
• Reduce resolver allocations when deduplicating package and distribution requests (#21810)

... (truncated)

Commits

• 01cb90c Hush some PEP 440 version warnings when dry-running Docker pushes (#21929)
• 9937fa2 Check remote wheel metadata prefetch ranges (#21919)
• 0f03963 Skip loading Python download metadata when listing installed interpreters (#2...
• 6d1b266 filter severity: labels in pr promotion automation (#21926)
• d269839 Bump version to 0.12.18 (#21924)
• 6716964 Avoid rebuilding a path into an absolute form (#21923)
• 4dd39e8 Use uncompressed editable wheels (#21918)
• 0c8da51 Add JSON output for uv pip install and uv pip sync (#21893)
• 0714322 Fix fragment boundaries in UrlString::base_str (#21920)
• 8460ef5 Share URL userinfo redaction (#21912)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/cloudai/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: cc72fe78-7f1a-4f69-9929-b85f7a97102b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}