Skip to content

chore(deps-dev): update uv-build requirement from <0.12,>=0.11.2 to >=0.11.2,<0.13 - #12

Merged
smorin merged 3 commits into
mainfrom
dependabot/pip/uv-build-gte-0.11.2-and-lt-0.13
Oct 1, 2026
Merged

chore(deps-dev): update uv-build requirement from <0.12,>=0.11.2 to >=0.11.2,<0.13#12
smorin merged 3 commits into
mainfrom
dependabot/pip/uv-build-gte-0.11.2-and-lt-0.13

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 29, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on uv-build to permit the latest version.

Release notes

Sourced from uv-build's releases.

0.12.19

Release Notes

Released on 2026-09-24.

Python

  • Add PyPy 3.11.16 and 3.12.14 (#21847)
  • Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

  • Format upload URLs with backticks in uv publish errors (#21934)

Preview features

  • Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)
  • Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

  • Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)
  • Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)
  • Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)
  • Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

  • Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

  • Make individual preview-feature reference entries linkable by name (#21950)

Install uv 0.12.19

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"

Download uv 0.12.19

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.12.19

Released on 2026-09-24.

Python

  • Add PyPy 3.11.16 and 3.12.14 (#21847)
  • Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

  • Format upload URLs with backticks in uv publish errors (#21934)

Preview features

  • Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)
  • Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

  • Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)
  • Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)
  • Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)
  • Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

  • Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

  • Make individual preview-feature reference entries linkable by name (#21950)

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

  • Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
  • Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
  • Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

  • Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Review in cubic

@dependabot
chore(deps-dev): update uv-build requirement
07db23d 
Updates the requirements on [uv-build](https://github.com/astral-sh/uv) to permit the latest version.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.2...0.12.19)

---
updated-dependencies:
- dependency-name: uv-build
  dependency-version: 0.12.19
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 29, 2026
@coderabbitai

coderabbitai Bot commented Sep 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 4130ff90-4510-4d50-9f4b-52a1bf2f2d9d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-01T07:01:24.803538Z 3b7c647 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@smorin
smorin merged commit 89755c9 into main Oct 1, 2026
17 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/uv-build-gte-0.11.2-and-lt-0.13 branch October 1, 2026 07:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@smorin