Skip to content

Use PEP 508 URLs for build backend requirements - #22577

Merged
konstin merged 1 commit into
mainfrom
charlie/codex-uv-build-requirement-urls
Oct 15, 2026
Merged

konstin merged 1 commit into
mainfrom
charlie/codex-uv-build-requirement-urls

Conversation

@astral-automations-bot

@astral-automations-bot astral-automations-bot Bot commented Oct 15, 2026 •

Copy link
Copy Markdown
Contributor

Summary

We decouple the build backend's parsing of build-system.requires from uv's supported installation sources. The build frontend resolves and installs these requirements before invoking the backend, so the backend should not enforce uv's Git transport or archive-format restrictions. We retain general requirement and URL parsing while removing distribution classification from this field, allowing the standalone uv-build binary to omit Git parsing and archive-extension inference.

This intentionally broadens acceptance. The backend now accepts Mercurial references such as hg+https://example.com/repo and archive download URLs without a recognized filename extension. It also accepts strings such as git+banana://example.com/repo and git+://example.com/repo that parse as URLs but fail uv's Git URL validation. Acceptance by the backend does not establish that a requirement is installable; the frontend owns that check. uv's direct-build validation and project-dependency parsing retain their existing URL checks.

In the Linux x86_64 comparison against main at e37c1f0c6, using Rust 1.99.0 and the stripped minimal-size profile, uv-build shrank from 3,075,808 to 3,029,232 bytes (46,576 bytes, 1.51%). This subsumes the standalone-binary size saving from astral-sh#2753; the two savings are not additive.

@astral-sh-bot

astral-sh-bot Bot commented Oct 15, 2026

Copy link
Copy Markdown

uv test inventory changes

This PR changes the tests when compared with the main base revision.

  • Added tests: 1
  • Removed tests: 0
  • Changed suites: 1
uv-build-backend: +1 / -0

Added:

  • uv-build-backend::metadata::tests::build_system_frontend_url

Removed: none

@codspeed

codspeed Bot commented Oct 15, 2026

Copy link
Copy Markdown

Merging this PR will improve performance by 8%

⚠️ 8 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 3 improved benchmarks
✅ 66 untouched benchmarks
⏩ 54 skipped benchmarks1

Performance Changes

Mode Benchmark BASE HEAD Efficiency
⚡ ⚠️ Simulation discover_workspace_from_all_members 152.9 ms 134.8 ms +13.39%
⚡ WallTime install_wheel_many_files 14.1 ms 13.4 ms +5.41%
⚡ WallTime discover_workspace_from_all_members 8.2 ms 7.8 ms +5.38%

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.


Comparing charlie/codex-uv-build-requirement-urls (bcbfc13) with main (3ea045b)

Open in CodSpeed

Footnotes

  1. 54 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@konstin
konstin merged commit 9385290 into main Oct 15, 2026
64 checks passed
@konstin
konstin deleted the charlie/codex-uv-build-requirement-urls branch October 15, 2026 09:10
hbjydev pushed a commit to hbjydev/phoebe that referenced this pull request Oct 20, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [uv](https://github.com/astral-sh/uv) | tools | patch | `0.13.0` → `0.13.3` |

---

### Release Notes

<details>
<summary>astral-sh/uv (uv)</summary>

### [`v0.13.3`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0133)

[Compare Source](astral-sh/uv@0.13.2...0.13.3)

Released on 2026-10-20.

##### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras ([#&#8203;22750](astral-sh/uv#22750))

### [`v0.13.2`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0132)

[Compare Source](astral-sh/uv@0.13.1...0.13.2)

Released on 2026-10-19.

##### Enhancements

- Report all installed packages in `uv workspace metadata`, including packages outside the selected resolution ([#&#8203;22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting `pylock.toml` ([#&#8203;22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index data ([#&#8203;22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require shell launchers ([#&#8203;22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover an interpreter, including with `-q` ([#&#8203;22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh ([#&#8203;22538](astral-sh/uv#22538), [#&#8203;22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's `[build-system].requires` validation ([#&#8203;22577](astral-sh/uv#22577))

##### Python

- Add PyPy 3.11.17 and 3.12.15 ([#&#8203;22578](astral-sh/uv#22578))

##### Preview features

- Fetch and parse PEP 825 index-level variant metadata with `wheel-variants` ([#&#8203;22509](astral-sh/uv#22509), [#&#8203;22511](astral-sh/uv#22511))

##### Performance

- Avoid exponential work when simplifying, traversing, and exporting complex dependency markers ([#&#8203;22608](astral-sh/uv#22608), [#&#8203;22615](astral-sh/uv#22615), [#&#8203;22651](astral-sh/uv#22651), [#&#8203;22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency markers ([#&#8203;22675](astral-sh/uv#22675), [#&#8203;22676](astral-sh/uv#22676), [#&#8203;22681](astral-sh/uv#22681))
- Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups ([#&#8203;22565](astral-sh/uv#22565), [#&#8203;22625](astral-sh/uv#22625))
- Speed up project discovery in large workspaces by caching member names ([#&#8203;22635](astral-sh/uv#22635))
- Reduce uv's binary size and speed up CycloneDX exports ([#&#8203;22431](astral-sh/uv#22431))
- Reduce `uv-build` binary size, including Linux x86_64 wheels ([#&#8203;22539](astral-sh/uv#22539), [#&#8203;22573](astral-sh/uv#22573))
- Reduce allocations when parsing TOML ([#&#8203;22679](astral-sh/uv#22679))

##### Bug fixes

- Respect `--exclude-newer` when a newer wheel for the selected source distribution is already cached ([#&#8203;22685](astral-sh/uv#22685))
- Prevent URL credentials from leaking through diagnostics or persisted metadata ([#&#8203;22600](astral-sh/uv#22600), [#&#8203;22601](astral-sh/uv#22601), [#&#8203;22617](astral-sh/uv#22617), [#&#8203;22622](astral-sh/uv#22622), [#&#8203;22646](astral-sh/uv#22646))
- Keep separate cache entries for signed `--find-links` URLs that differ only in sensitive query values ([#&#8203;22630](astral-sh/uv#22630))
- Honor PEP 751 environment restrictions when installing or syncing from `pylock.toml` ([#&#8203;22594](astral-sh/uv#22594))
- Use configured credentials before prompting during `uv publish`, and avoid prompting when no upload occurs ([#&#8203;22593](astral-sh/uv#22593))
- Match recursive build globs against complete file paths and ignore invalid license symlinks ([#&#8203;22581](astral-sh/uv#22581), [#&#8203;22583](astral-sh/uv#22583))
- Return an error for invalid `uv pip compile --python-version` values instead of panicking ([#&#8203;22727](astral-sh/uv#22727))
- Reject invalid `pylock.toml` output filenames before resolution instead of panicking ([#&#8203;22725](astral-sh/uv#22725))
- Avoid panicking during repeated resolution conflicts involving fixed-priority packages ([#&#8203;22589](astral-sh/uv#22589))
- Create version aliases correctly when installing managed Python into a relative directory ([#&#8203;22547](astral-sh/uv#22547))
- Show incompatibilities from failing `uv pip check` invocations with `-q` ([#&#8203;22544](astral-sh/uv#22544))
- Treat logically equivalent dependency markers as equal regardless of construction order ([#&#8203;22680](astral-sh/uv#22680))

##### Rust API

- Require the opt-in `unsafe-url` feature to use raw `url::Url` APIs in `uv-pep508` ([#&#8203;22623](astral-sh/uv#22623))

##### Documentation

- Clarify credential lookup, environment synchronization, managed Python, and integration guidance ([#&#8203;22542](astral-sh/uv#22542))

##### Other changes

- Use stable `sh.astral.*` signing identifiers for macOS binaries ([#&#8203;22648](astral-sh/uv#22648))

### [`v0.13.1`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0131)

[Compare Source](astral-sh/uv@0.13.0...0.13.1)

Released on 2026-10-14.

##### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#&#8203;22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#&#8203;22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors ([#&#8203;22241](astral-sh/uv#22241))

##### Python

- Add CPython 3.16.0a1 ([#&#8203;22527](astral-sh/uv#22527))

##### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#&#8203;22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#&#8203;22039](astral-sh/uv#22039))

##### Performance

- Reduce uv's binary size ([#&#8203;22429](astral-sh/uv#22429), [#&#8203;22430](astral-sh/uv#22430), [#&#8203;22432](astral-sh/uv#22432))
- Speed up Simple API parsing ([#&#8203;22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead ([#&#8203;22239](astral-sh/uv#22239))

##### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#&#8203;22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or full-length tar user or group names ([#&#8203;22516](astral-sh/uv#22516), [#&#8203;22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#&#8203;22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#&#8203;22520](astral-sh/uv#22520))
- Prevent concurrent readers from observing partially written lockfiles, Python version files, or managed Python sysconfig files ([#&#8203;22399](astral-sh/uv#22399), [#&#8203;22402](astral-sh/uv#22402), [#&#8203;22403](astral-sh/uv#22403))
- Serialize concurrent project commands that reach the same environment through real and symlinked paths ([#&#8203;22390](astral-sh/uv#22390))
- Prevent installs, syncs, and environment creation from failing when they race with `uv cache clean` ([#&#8203;22387](astral-sh/uv#22387))
- Prevent concurrent tool installations from corrupting an environment when the last tool is uninstalled ([#&#8203;22391](astral-sh/uv#22391))
- Persist changed upgrade settings even when `uv tool upgrade` leaves the tool version unchanged ([#&#8203;22499](astral-sh/uv#22499))
- Reuse environments with installed Git dependencies pinned to full commit hashes without resolving again ([#&#8203;22464](astral-sh/uv#22464))

##### Documentation

- Explain how to select an emulated Python interpreter on Windows ARM64 when native wheels are unavailable ([#&#8203;22424](astral-sh/uv#22424))
- Fix the `.netrc` format documentation link ([#&#8203;22514](astral-sh/uv#22514))

##### Other changes

- Publish Python 3.15-based uv Docker images under stable tags ([#&#8203;22503](astral-sh/uv#22503))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjcuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2Ny41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItcmVsZWFzZSIsInR5cGUvcGF0Y2giXX0=-->

Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/905
luketainton pushed a commit to luketainton/luke_rsu that referenced this pull request Oct 22, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.13.1` → `0.13.5` |

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.13.5`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0135)

[Compare Source](astral-sh/uv@0.13.4...0.13.5)

Released on 2026-10-21.

Following [uv 0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to [python-build-standalone 20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021), including the CPython [3.15.1](https://www.python.org/downloads/release/python-3151/), [3.14.9](https://www.python.org/downloads/release/python-3149/), and [3.13.17](https://www.python.org/downloads/release/python-31317/) security patch releases. These builds include [pip 26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled in the managed interpreter and bundled with `ensurepip`, which installs pip by default when you run `python -m venv`. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run `uv python upgrade` to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.

##### Enhancements

- Report incompatible self-dependencies directly in resolution errors ([#&#8203;21845](astral-sh/uv#21845))

##### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17 ([#&#8203;22802](astral-sh/uv#22802))

##### Preview features

- Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with `wheel-variants` ([#&#8203;22535](astral-sh/uv#22535), [#&#8203;22536](astral-sh/uv#22536), [#&#8203;22687](astral-sh/uv#22687), [#&#8203;22688](astral-sh/uv#22688))

##### Performance

- Reduce peak memory use when resolving dependencies across multiple environments ([#&#8203;22769](astral-sh/uv#22769), [#&#8203;22770](astral-sh/uv#22770), [#&#8203;22784](astral-sh/uv#22784))
- Speed up exports with complex transitive extras by resolving activation across the dependency graph ([#&#8203;22751](astral-sh/uv#22751))
- Reduce uv's binary size by keeping additional error formatters out of line ([#&#8203;22775](astral-sh/uv#22775))
- Reduce overhead when parsing custom build cache keys ([#&#8203;22749](astral-sh/uv#22749))

##### Bug fixes

- Lock packages distributed only as Android wheels without a source distribution ([#&#8203;22806](astral-sh/uv#22806))
- Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths ([#&#8203;22751](astral-sh/uv#22751))
- Reject invalid custom build cache keys instead of silently falling back to the defaults ([#&#8203;22749](astral-sh/uv#22749))

##### Security

- Reject certificate chains containing compromised eMudhra intermediate keys via `rustls-webpki` 0.103.16 ([#&#8203;22777](astral-sh/uv#22777))
- Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates ([#&#8203;22773](astral-sh/uv#22773))

### [`v0.13.4`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0134)

[Compare Source](astral-sh/uv@0.13.3...0.13.4)

Released on 2026-10-20.

##### Preview features

- Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under `wheel-variants` ([#&#8203;22512](astral-sh/uv#22512))

##### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs` 1.0.10 ([#&#8203;22760](astral-sh/uv#22760))

### [`v0.13.3`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0133)

[Compare Source](astral-sh/uv@0.13.2...0.13.3)

Released on 2026-10-20.

##### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras ([#&#8203;22750](astral-sh/uv#22750))

### [`v0.13.2`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0132)

[Compare Source](astral-sh/uv@0.13.1...0.13.2)

Released on 2026-10-19.

##### Enhancements

- Report all installed packages in `uv workspace metadata`, including packages outside the selected resolution ([#&#8203;22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting `pylock.toml` ([#&#8203;22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index data ([#&#8203;22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require shell launchers ([#&#8203;22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover an interpreter, including with `-q` ([#&#8203;22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh ([#&#8203;22538](astral-sh/uv#22538), [#&#8203;22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's `[build-system].requires` validation ([#&#8203;22577](astral-sh/uv#22577))

##### Python

- Add PyPy 3.11.17 and 3.12.15 ([#&#8203;22578](astral-sh/uv#22578))

##### Preview features

- Fetch and parse PEP 825 index-level variant metadata with `wheel-variants` ([#&#8203;22509](astral-sh/uv#22509), [#&#8203;22511](astral-sh/uv#22511))

##### Performance

- Avoid exponential work when simplifying, traversing, and exporting complex dependency markers ([#&#8203;22608](astral-sh/uv#22608), [#&#8203;22615](astral-sh/uv#22615), [#&#8203;22651](astral-sh/uv#22651), [#&#8203;22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency markers ([#&#8203;22675](astral-sh/uv#22675), [#&#8203;22676](astral-sh/uv#22676), [#&#8203;22681](astral-sh/uv#22681))
- Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups ([#&#8203;22565](astral-sh/uv#22565), [#&#8203;22625](astral-sh/uv#22625))
- Speed up project discovery in large workspaces by caching member names ([#&#8203;22635](astral-sh/uv#22635))
- Reduce uv's binary size and speed up CycloneDX exports ([#&#8203;22431](astral-sh/uv#22431))
- Reduce `uv-build` binary size, including Linux x86_64 wheels ([#&#8203;22539](astral-sh/uv#22539), [#&#8203;22573](astral-sh/uv#22573))
- Reduce allocations when parsing TOML ([#&#8203;22679](astral-sh/uv#22679))

##### Bug fixes

- Respect `--exclude-newer` when a newer wheel for the selected source distribution is already cached ([#&#8203;22685](astral-sh/uv#22685))
- Prevent URL credentials from leaking through diagnostics or persisted metadata ([#&#8203;22600](astral-sh/uv#22600), [#&#8203;22601](astral-sh/uv#22601), [#&#8203;22617](astral-sh/uv#22617), [#&#8203;22622](astral-sh/uv#22622), [#&#8203;22646](astral-sh/uv#22646))
- Keep separate cache entries for signed `--find-links` URLs that differ only in sensitive query values ([#&#8203;22630](astral-sh/uv#22630))
- Honor PEP 751 environment restrictions when installing or syncing from `pylock.toml` ([#&#8203;22594](astral-sh/uv#22594))
- Use configured credentials before prompting during `uv publish`, and avoid prompting when no upload occurs ([#&#8203;22593](astral-sh/uv#22593))
- Match recursive build globs against complete file paths and ignore invalid license symlinks ([#&#8203;22581](astral-sh/uv#22581), [#&#8203;22583](astral-sh/uv#22583))
- Return an error for invalid `uv pip compile --python-version` values instead of panicking ([#&#8203;22727](astral-sh/uv#22727))
- Reject invalid `pylock.toml` output filenames before resolution instead of panicking ([#&#8203;22725](astral-sh/uv#22725))
- Avoid panicking during repeated resolution conflicts involving fixed-priority packages ([#&#8203;22589](astral-sh/uv#22589))
- Create version aliases correctly when installing managed Python into a relative directory ([#&#8203;22547](astral-sh/uv#22547))
- Show incompatibilities from failing `uv pip check` invocations with `-q` ([#&#8203;22544](astral-sh/uv#22544))
- Treat logically equivalent dependency markers as equal regardless of construction order ([#&#8203;22680](astral-sh/uv#22680))

##### Rust API

- Require the opt-in `unsafe-url` feature to use raw `url::Url` APIs in `uv-pep508` ([#&#8203;22623](astral-sh/uv#22623))

##### Documentation

- Clarify credential lookup, environment synchronization, managed Python, and integration guidance ([#&#8203;22542](astral-sh/uv#22542))

##### Other changes

- Use stable `sh.astral.*` signing identifiers for macOS binaries ([#&#8203;22648](astral-sh/uv#22648))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjAuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->

Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/61
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
luketainton pushed a commit to luketainton/repos_labmcp that referenced this pull request Oct 24, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.13.1` → `0.13.5` |

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.13.5`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0135)

[Compare Source](astral-sh/uv@0.13.4...0.13.5)

Released on 2026-10-21.

Following [uv 0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to [python-build-standalone 20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021), including the CPython [3.15.1](https://www.python.org/downloads/release/python-3151/), [3.14.9](https://www.python.org/downloads/release/python-3149/), and [3.13.17](https://www.python.org/downloads/release/python-31317/) security patch releases. These builds include [pip 26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled in the managed interpreter and bundled with `ensurepip`, which installs pip by default when you run `python -m venv`. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run `uv python upgrade` to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.

##### Enhancements

- Report incompatible self-dependencies directly in resolution errors ([#&#8203;21845](astral-sh/uv#21845))

##### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17 ([#&#8203;22802](astral-sh/uv#22802))

##### Preview features

- Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with `wheel-variants` ([#&#8203;22535](astral-sh/uv#22535), [#&#8203;22536](astral-sh/uv#22536), [#&#8203;22687](astral-sh/uv#22687), [#&#8203;22688](astral-sh/uv#22688))

##### Performance

- Reduce peak memory use when resolving dependencies across multiple environments ([#&#8203;22769](astral-sh/uv#22769), [#&#8203;22770](astral-sh/uv#22770), [#&#8203;22784](astral-sh/uv#22784))
- Speed up exports with complex transitive extras by resolving activation across the dependency graph ([#&#8203;22751](astral-sh/uv#22751))
- Reduce uv's binary size by keeping additional error formatters out of line ([#&#8203;22775](astral-sh/uv#22775))
- Reduce overhead when parsing custom build cache keys ([#&#8203;22749](astral-sh/uv#22749))

##### Bug fixes

- Lock packages distributed only as Android wheels without a source distribution ([#&#8203;22806](astral-sh/uv#22806))
- Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths ([#&#8203;22751](astral-sh/uv#22751))
- Reject invalid custom build cache keys instead of silently falling back to the defaults ([#&#8203;22749](astral-sh/uv#22749))

##### Security

- Reject certificate chains containing compromised eMudhra intermediate keys via `rustls-webpki` 0.103.16 ([#&#8203;22777](astral-sh/uv#22777))
- Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates ([#&#8203;22773](astral-sh/uv#22773))

### [`v0.13.4`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0134)

[Compare Source](astral-sh/uv@0.13.3...0.13.4)

Released on 2026-10-20.

##### Preview features

- Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under `wheel-variants` ([#&#8203;22512](astral-sh/uv#22512))

##### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs` 1.0.10 ([#&#8203;22760](astral-sh/uv#22760))

### [`v0.13.3`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0133)

[Compare Source](astral-sh/uv@0.13.2...0.13.3)

Released on 2026-10-20.

##### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras ([#&#8203;22750](astral-sh/uv#22750))

### [`v0.13.2`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0132)

[Compare Source](astral-sh/uv@0.13.1...0.13.2)

Released on 2026-10-19.

##### Enhancements

- Report all installed packages in `uv workspace metadata`, including packages outside the selected resolution ([#&#8203;22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting `pylock.toml` ([#&#8203;22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index data ([#&#8203;22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require shell launchers ([#&#8203;22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover an interpreter, including with `-q` ([#&#8203;22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh ([#&#8203;22538](astral-sh/uv#22538), [#&#8203;22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's `[build-system].requires` validation ([#&#8203;22577](astral-sh/uv#22577))

##### Python

- Add PyPy 3.11.17 and 3.12.15 ([#&#8203;22578](astral-sh/uv#22578))

##### Preview features

- Fetch and parse PEP 825 index-level variant metadata with `wheel-variants` ([#&#8203;22509](astral-sh/uv#22509), [#&#8203;22511](astral-sh/uv#22511))

##### Performance

- Avoid exponential work when simplifying, traversing, and exporting complex dependency markers ([#&#8203;22608](astral-sh/uv#22608), [#&#8203;22615](astral-sh/uv#22615), [#&#8203;22651](astral-sh/uv#22651), [#&#8203;22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency markers ([#&#8203;22675](astral-sh/uv#22675), [#&#8203;22676](astral-sh/uv#22676), [#&#8203;22681](astral-sh/uv#22681))
- Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups ([#&#8203;22565](astral-sh/uv#22565), [#&#8203;22625](astral-sh/uv#22625))
- Speed up project discovery in large workspaces by caching member names ([#&#8203;22635](astral-sh/uv#22635))
- Reduce uv's binary size and speed up CycloneDX exports ([#&#8203;22431](astral-sh/uv#22431))
- Reduce `uv-build` binary size, including Linux x86_64 wheels ([#&#8203;22539](astral-sh/uv#22539), [#&#8203;22573](astral-sh/uv#22573))
- Reduce allocations when parsing TOML ([#&#8203;22679](astral-sh/uv#22679))

##### Bug fixes

- Respect `--exclude-newer` when a newer wheel for the selected source distribution is already cached ([#&#8203;22685](astral-sh/uv#22685))
- Prevent URL credentials from leaking through diagnostics or persisted metadata ([#&#8203;22600](astral-sh/uv#22600), [#&#8203;22601](astral-sh/uv#22601), [#&#8203;22617](astral-sh/uv#22617), [#&#8203;22622](astral-sh/uv#22622), [#&#8203;22646](astral-sh/uv#22646))
- Keep separate cache entries for signed `--find-links` URLs that differ only in sensitive query values ([#&#8203;22630](astral-sh/uv#22630))
- Honor PEP 751 environment restrictions when installing or syncing from `pylock.toml` ([#&#8203;22594](astral-sh/uv#22594))
- Use configured credentials before prompting during `uv publish`, and avoid prompting when no upload occurs ([#&#8203;22593](astral-sh/uv#22593))
- Match recursive build globs against complete file paths and ignore invalid license symlinks ([#&#8203;22581](astral-sh/uv#22581), [#&#8203;22583](astral-sh/uv#22583))
- Return an error for invalid `uv pip compile --python-version` values instead of panicking ([#&#8203;22727](astral-sh/uv#22727))
- Reject invalid `pylock.toml` output filenames before resolution instead of panicking ([#&#8203;22725](astral-sh/uv#22725))
- Avoid panicking during repeated resolution conflicts involving fixed-priority packages ([#&#8203;22589](astral-sh/uv#22589))
- Create version aliases correctly when installing managed Python into a relative directory ([#&#8203;22547](astral-sh/uv#22547))
- Show incompatibilities from failing `uv pip check` invocations with `-q` ([#&#8203;22544](astral-sh/uv#22544))
- Treat logically equivalent dependency markers as equal regardless of construction order ([#&#8203;22680](astral-sh/uv#22680))

##### Rust API

- Require the opt-in `unsafe-url` feature to use raw `url::Url` APIs in `uv-pep508` ([#&#8203;22623](astral-sh/uv#22623))

##### Documentation

- Clarify credential lookup, environment synchronization, managed Python, and integration guidance ([#&#8203;22542](astral-sh/uv#22542))

##### Other changes

- Use stable `sh.astral.*` signing identifiers for macOS binaries ([#&#8203;22648](astral-sh/uv#22648))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjAuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->

Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/81
Reviewed-by: Luke Tainton <luke@tainton.uk>
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator aube
editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `pinact` | `5.0.0` → `5.0.1` | `5.0.0` → `5.0.1` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>pinact: `5.0.0` → `5.0.1` (suzuki-shunsuke/pinact)</summary>

### v5.0.1

suzuki-shunsuke/pinact@v5.0.0...v5.0.1

## ⚠️ Security

#1792 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes
[CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now
refuses trust in a small set of intermediate certificates of a specific
Certificate Authority, after its CA keys were reported compromised.
`Verify` filters out chains containing those intermediates. The Go team
highly recommends upgrading immediately.

pinact relies on `crypto/x509` to verify the TLS certificate of GitHub
when it calls the GitHub API, with your access token if one is set, to
resolve the commit SHAs that workflows are pinned to. We recommend
upgrading.

ref.

- https://go.dev/doc/devel/release#go1.27.3
-
https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

This release also includes Go 1.27.2 (#1764), which has security fixes
to the `go` command and the `crypto/tls`, `html/template`, `net/http`,
`net/textproto`, and `os` packages.

- https://go.dev/doc/devel/release#go1.27.2

## Others

#1766 ci: Update GitHub Actions runner to ubuntu-26.04
#1767 ci: Use download-go-module-action
#1768 ci: Share Go modules between integration test and
go-test-full-workflow
#1774 ci: Use the reusable workflow of go-autofix-action
#1782 ci: Replace go-test-full-workflow with go-test-workflow and
test-workflow

## Dependency updates

#1764 #1792 Update Go to v1.27.3
#1730 #1789 Update github.com/google/go-github to v93
#1739 Update github.com/suzuki-shunsuke/cobra-util to v0.0.5
#1723 Update github.com/sourcegraph/go-diff to v0.9.0

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (4 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (4 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (4 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (4 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This branch was previously deployed

1 inactive deployment
automations — bcbfc13b Deployed Oct 15, 2026 by astral-automations-bot[bot] via review / security review #51029
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working compatibility Compatibility with a specification or another tool

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants