Repository navigation
Use PEP 508 URLs for build backend requirements - #22577
Conversation
uv test inventory changesThis PR changes the tests when compared with the
|
Merging this PR will improve performance by 8%
|
| Mode | Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|---|
| ⚡ |
Simulation | discover_workspace_from_all_members |
152.9 ms | 134.8 ms | +13.39% |
| ⚡ | WallTime | install_wheel_many_files |
14.1 ms | 13.4 ms | +5.41% |
| ⚡ | WallTime | discover_workspace_from_all_members |
8.2 ms | 7.8 ms | +5.38% |
Tip
Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.
Comparing charlie/codex-uv-build-requirement-urls (bcbfc13) with main (3ea045b)
Footnotes
-
54 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [uv](https://github.com/astral-sh/uv) | tools | patch | `0.13.0` → `0.13.3` | --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.13.3`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0133) [Compare Source](astral-sh/uv@0.13.2...0.13.3) Released on 2026-10-20. ##### Performance - Avoid severe `uv export` slowdowns in dependency graphs with extras ([#​22750](astral-sh/uv#22750)) ### [`v0.13.2`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0132) [Compare Source](astral-sh/uv@0.13.1...0.13.2) Released on 2026-10-19. ##### Enhancements - Report all installed packages in `uv workspace metadata`, including packages outside the selected resolution ([#​22395](astral-sh/uv#22395)) - Include supported environment restrictions when exporting `pylock.toml` ([#​22596](astral-sh/uv#22596)) - Retry dropped GET and HEAD requests when fetching package and index data ([#​22672](astral-sh/uv#22672)) - Preserve encoding declarations in wheel data scripts that require shell launchers ([#​22526](astral-sh/uv#22526)) - Show causes and hints when `uv python find --script` cannot discover an interpreter, including with `-q` ([#​22549](astral-sh/uv#22549)) - Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh ([#​22538](astral-sh/uv#22538), [#​22572](astral-sh/uv#22572)) - Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's `[build-system].requires` validation ([#​22577](astral-sh/uv#22577)) ##### Python - Add PyPy 3.11.17 and 3.12.15 ([#​22578](astral-sh/uv#22578)) ##### Preview features - Fetch and parse PEP 825 index-level variant metadata with `wheel-variants` ([#​22509](astral-sh/uv#22509), [#​22511](astral-sh/uv#22511)) ##### Performance - Avoid exponential work when simplifying, traversing, and exporting complex dependency markers ([#​22608](astral-sh/uv#22608), [#​22615](astral-sh/uv#22615), [#​22651](astral-sh/uv#22651), [#​22674](astral-sh/uv#22674)) - Reduce the time and memory used to parse and store complex dependency markers ([#​22675](astral-sh/uv#22675), [#​22676](astral-sh/uv#22676), [#​22681](astral-sh/uv#22681)) - Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups ([#​22565](astral-sh/uv#22565), [#​22625](astral-sh/uv#22625)) - Speed up project discovery in large workspaces by caching member names ([#​22635](astral-sh/uv#22635)) - Reduce uv's binary size and speed up CycloneDX exports ([#​22431](astral-sh/uv#22431)) - Reduce `uv-build` binary size, including Linux x86_64 wheels ([#​22539](astral-sh/uv#22539), [#​22573](astral-sh/uv#22573)) - Reduce allocations when parsing TOML ([#​22679](astral-sh/uv#22679)) ##### Bug fixes - Respect `--exclude-newer` when a newer wheel for the selected source distribution is already cached ([#​22685](astral-sh/uv#22685)) - Prevent URL credentials from leaking through diagnostics or persisted metadata ([#​22600](astral-sh/uv#22600), [#​22601](astral-sh/uv#22601), [#​22617](astral-sh/uv#22617), [#​22622](astral-sh/uv#22622), [#​22646](astral-sh/uv#22646)) - Keep separate cache entries for signed `--find-links` URLs that differ only in sensitive query values ([#​22630](astral-sh/uv#22630)) - Honor PEP 751 environment restrictions when installing or syncing from `pylock.toml` ([#​22594](astral-sh/uv#22594)) - Use configured credentials before prompting during `uv publish`, and avoid prompting when no upload occurs ([#​22593](astral-sh/uv#22593)) - Match recursive build globs against complete file paths and ignore invalid license symlinks ([#​22581](astral-sh/uv#22581), [#​22583](astral-sh/uv#22583)) - Return an error for invalid `uv pip compile --python-version` values instead of panicking ([#​22727](astral-sh/uv#22727)) - Reject invalid `pylock.toml` output filenames before resolution instead of panicking ([#​22725](astral-sh/uv#22725)) - Avoid panicking during repeated resolution conflicts involving fixed-priority packages ([#​22589](astral-sh/uv#22589)) - Create version aliases correctly when installing managed Python into a relative directory ([#​22547](astral-sh/uv#22547)) - Show incompatibilities from failing `uv pip check` invocations with `-q` ([#​22544](astral-sh/uv#22544)) - Treat logically equivalent dependency markers as equal regardless of construction order ([#​22680](astral-sh/uv#22680)) ##### Rust API - Require the opt-in `unsafe-url` feature to use raw `url::Url` APIs in `uv-pep508` ([#​22623](astral-sh/uv#22623)) ##### Documentation - Clarify credential lookup, environment synchronization, managed Python, and integration guidance ([#​22542](astral-sh/uv#22542)) ##### Other changes - Use stable `sh.astral.*` signing identifiers for macOS binaries ([#​22648](astral-sh/uv#22648)) ### [`v0.13.1`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0131) [Compare Source](astral-sh/uv@0.13.0...0.13.1) Released on 2026-10-14. ##### Enhancements - Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#​22500](astral-sh/uv#22500)) - Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#​22463](astral-sh/uv#22463)) - Report missing trusted hashes in resolution errors ([#​22241](astral-sh/uv#22241)) ##### Python - Add CPython 3.16.0a1 ([#​22527](astral-sh/uv#22527)) ##### Preview features - Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#​22498](astral-sh/uv#22498)) - Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#​22039](astral-sh/uv#22039)) ##### Performance - Reduce uv's binary size ([#​22429](astral-sh/uv#22429), [#​22430](astral-sh/uv#22430), [#​22432](astral-sh/uv#22432)) - Speed up Simple API parsing ([#​22429](astral-sh/uv#22429)) - Reduce package metadata parsing overhead ([#​22239](astral-sh/uv#22239)) ##### Bug fixes - Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#​22495](astral-sh/uv#22495)) - Restore support for source distributions containing hard links or full-length tar user or group names ([#​22516](astral-sh/uv#22516), [#​22522](astral-sh/uv#22522)) - Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#​22496](astral-sh/uv#22496)) - Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#​22520](astral-sh/uv#22520)) - Prevent concurrent readers from observing partially written lockfiles, Python version files, or managed Python sysconfig files ([#​22399](astral-sh/uv#22399), [#​22402](astral-sh/uv#22402), [#​22403](astral-sh/uv#22403)) - Serialize concurrent project commands that reach the same environment through real and symlinked paths ([#​22390](astral-sh/uv#22390)) - Prevent installs, syncs, and environment creation from failing when they race with `uv cache clean` ([#​22387](astral-sh/uv#22387)) - Prevent concurrent tool installations from corrupting an environment when the last tool is uninstalled ([#​22391](astral-sh/uv#22391)) - Persist changed upgrade settings even when `uv tool upgrade` leaves the tool version unchanged ([#​22499](astral-sh/uv#22499)) - Reuse environments with installed Git dependencies pinned to full commit hashes without resolving again ([#​22464](astral-sh/uv#22464)) ##### Documentation - Explain how to select an emulated Python interpreter on Windows ARM64 when native wheels are unavailable ([#​22424](astral-sh/uv#22424)) - Fix the `.netrc` format documentation link ([#​22514](astral-sh/uv#22514)) ##### Other changes - Publish Python 3.15-based uv Docker images under stable tags ([#​22503](astral-sh/uv#22503)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjcuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2Ny41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItcmVsZWFzZSIsInR5cGUvcGF0Y2giXX0=--> Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/905
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.13.1` → `0.13.5` | --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.13.5`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0135) [Compare Source](astral-sh/uv@0.13.4...0.13.5) Released on 2026-10-21. Following [uv 0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to [python-build-standalone 20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021), including the CPython [3.15.1](https://www.python.org/downloads/release/python-3151/), [3.14.9](https://www.python.org/downloads/release/python-3149/), and [3.13.17](https://www.python.org/downloads/release/python-31317/) security patch releases. These builds include [pip 26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled in the managed interpreter and bundled with `ensurepip`, which installs pip by default when you run `python -m venv`. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run `uv python upgrade` to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments. Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions. ##### Enhancements - Report incompatible self-dependencies directly in resolution errors ([#​21845](astral-sh/uv#21845)) ##### Python - Add CPython 3.15.1, 3.14.9, and 3.13.17 ([#​22802](astral-sh/uv#22802)) ##### Preview features - Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with `wheel-variants` ([#​22535](astral-sh/uv#22535), [#​22536](astral-sh/uv#22536), [#​22687](astral-sh/uv#22687), [#​22688](astral-sh/uv#22688)) ##### Performance - Reduce peak memory use when resolving dependencies across multiple environments ([#​22769](astral-sh/uv#22769), [#​22770](astral-sh/uv#22770), [#​22784](astral-sh/uv#22784)) - Speed up exports with complex transitive extras by resolving activation across the dependency graph ([#​22751](astral-sh/uv#22751)) - Reduce uv's binary size by keeping additional error formatters out of line ([#​22775](astral-sh/uv#22775)) - Reduce overhead when parsing custom build cache keys ([#​22749](astral-sh/uv#22749)) ##### Bug fixes - Lock packages distributed only as Android wheels without a source distribution ([#​22806](astral-sh/uv#22806)) - Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths ([#​22751](astral-sh/uv#22751)) - Reject invalid custom build cache keys instead of silently falling back to the defaults ([#​22749](astral-sh/uv#22749)) ##### Security - Reject certificate chains containing compromised eMudhra intermediate keys via `rustls-webpki` 0.103.16 ([#​22777](astral-sh/uv#22777)) - Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates ([#​22773](astral-sh/uv#22773)) ### [`v0.13.4`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0134) [Compare Source](astral-sh/uv@0.13.3...0.13.4) Released on 2026-10-20. ##### Preview features - Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under `wheel-variants` ([#​22512](astral-sh/uv#22512)) ##### Other changes - Update the bundled Mozilla root certificates via `webpki-root-certs` 1.0.10 ([#​22760](astral-sh/uv#22760)) ### [`v0.13.3`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0133) [Compare Source](astral-sh/uv@0.13.2...0.13.3) Released on 2026-10-20. ##### Performance - Avoid severe `uv export` slowdowns in dependency graphs with extras ([#​22750](astral-sh/uv#22750)) ### [`v0.13.2`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0132) [Compare Source](astral-sh/uv@0.13.1...0.13.2) Released on 2026-10-19. ##### Enhancements - Report all installed packages in `uv workspace metadata`, including packages outside the selected resolution ([#​22395](astral-sh/uv#22395)) - Include supported environment restrictions when exporting `pylock.toml` ([#​22596](astral-sh/uv#22596)) - Retry dropped GET and HEAD requests when fetching package and index data ([#​22672](astral-sh/uv#22672)) - Preserve encoding declarations in wheel data scripts that require shell launchers ([#​22526](astral-sh/uv#22526)) - Show causes and hints when `uv python find --script` cannot discover an interpreter, including with `-q` ([#​22549](astral-sh/uv#22549)) - Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh ([#​22538](astral-sh/uv#22538), [#​22572](astral-sh/uv#22572)) - Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's `[build-system].requires` validation ([#​22577](astral-sh/uv#22577)) ##### Python - Add PyPy 3.11.17 and 3.12.15 ([#​22578](astral-sh/uv#22578)) ##### Preview features - Fetch and parse PEP 825 index-level variant metadata with `wheel-variants` ([#​22509](astral-sh/uv#22509), [#​22511](astral-sh/uv#22511)) ##### Performance - Avoid exponential work when simplifying, traversing, and exporting complex dependency markers ([#​22608](astral-sh/uv#22608), [#​22615](astral-sh/uv#22615), [#​22651](astral-sh/uv#22651), [#​22674](astral-sh/uv#22674)) - Reduce the time and memory used to parse and store complex dependency markers ([#​22675](astral-sh/uv#22675), [#​22676](astral-sh/uv#22676), [#​22681](astral-sh/uv#22681)) - Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups ([#​22565](astral-sh/uv#22565), [#​22625](astral-sh/uv#22625)) - Speed up project discovery in large workspaces by caching member names ([#​22635](astral-sh/uv#22635)) - Reduce uv's binary size and speed up CycloneDX exports ([#​22431](astral-sh/uv#22431)) - Reduce `uv-build` binary size, including Linux x86_64 wheels ([#​22539](astral-sh/uv#22539), [#​22573](astral-sh/uv#22573)) - Reduce allocations when parsing TOML ([#​22679](astral-sh/uv#22679)) ##### Bug fixes - Respect `--exclude-newer` when a newer wheel for the selected source distribution is already cached ([#​22685](astral-sh/uv#22685)) - Prevent URL credentials from leaking through diagnostics or persisted metadata ([#​22600](astral-sh/uv#22600), [#​22601](astral-sh/uv#22601), [#​22617](astral-sh/uv#22617), [#​22622](astral-sh/uv#22622), [#​22646](astral-sh/uv#22646)) - Keep separate cache entries for signed `--find-links` URLs that differ only in sensitive query values ([#​22630](astral-sh/uv#22630)) - Honor PEP 751 environment restrictions when installing or syncing from `pylock.toml` ([#​22594](astral-sh/uv#22594)) - Use configured credentials before prompting during `uv publish`, and avoid prompting when no upload occurs ([#​22593](astral-sh/uv#22593)) - Match recursive build globs against complete file paths and ignore invalid license symlinks ([#​22581](astral-sh/uv#22581), [#​22583](astral-sh/uv#22583)) - Return an error for invalid `uv pip compile --python-version` values instead of panicking ([#​22727](astral-sh/uv#22727)) - Reject invalid `pylock.toml` output filenames before resolution instead of panicking ([#​22725](astral-sh/uv#22725)) - Avoid panicking during repeated resolution conflicts involving fixed-priority packages ([#​22589](astral-sh/uv#22589)) - Create version aliases correctly when installing managed Python into a relative directory ([#​22547](astral-sh/uv#22547)) - Show incompatibilities from failing `uv pip check` invocations with `-q` ([#​22544](astral-sh/uv#22544)) - Treat logically equivalent dependency markers as equal regardless of construction order ([#​22680](astral-sh/uv#22680)) ##### Rust API - Require the opt-in `unsafe-url` feature to use raw `url::Url` APIs in `uv-pep508` ([#​22623](astral-sh/uv#22623)) ##### Documentation - Clarify credential lookup, environment synchronization, managed Python, and integration guidance ([#​22542](astral-sh/uv#22542)) ##### Other changes - Use stable `sh.astral.*` signing identifiers for macOS binaries ([#​22648](astral-sh/uv#22648)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjAuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==--> Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/61 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.13.1` → `0.13.5` | --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.13.5`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0135) [Compare Source](astral-sh/uv@0.13.4...0.13.5) Released on 2026-10-21. Following [uv 0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to [python-build-standalone 20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021), including the CPython [3.15.1](https://www.python.org/downloads/release/python-3151/), [3.14.9](https://www.python.org/downloads/release/python-3149/), and [3.13.17](https://www.python.org/downloads/release/python-31317/) security patch releases. These builds include [pip 26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled in the managed interpreter and bundled with `ensurepip`, which installs pip by default when you run `python -m venv`. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run `uv python upgrade` to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments. Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions. ##### Enhancements - Report incompatible self-dependencies directly in resolution errors ([#​21845](astral-sh/uv#21845)) ##### Python - Add CPython 3.15.1, 3.14.9, and 3.13.17 ([#​22802](astral-sh/uv#22802)) ##### Preview features - Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with `wheel-variants` ([#​22535](astral-sh/uv#22535), [#​22536](astral-sh/uv#22536), [#​22687](astral-sh/uv#22687), [#​22688](astral-sh/uv#22688)) ##### Performance - Reduce peak memory use when resolving dependencies across multiple environments ([#​22769](astral-sh/uv#22769), [#​22770](astral-sh/uv#22770), [#​22784](astral-sh/uv#22784)) - Speed up exports with complex transitive extras by resolving activation across the dependency graph ([#​22751](astral-sh/uv#22751)) - Reduce uv's binary size by keeping additional error formatters out of line ([#​22775](astral-sh/uv#22775)) - Reduce overhead when parsing custom build cache keys ([#​22749](astral-sh/uv#22749)) ##### Bug fixes - Lock packages distributed only as Android wheels without a source distribution ([#​22806](astral-sh/uv#22806)) - Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths ([#​22751](astral-sh/uv#22751)) - Reject invalid custom build cache keys instead of silently falling back to the defaults ([#​22749](astral-sh/uv#22749)) ##### Security - Reject certificate chains containing compromised eMudhra intermediate keys via `rustls-webpki` 0.103.16 ([#​22777](astral-sh/uv#22777)) - Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates ([#​22773](astral-sh/uv#22773)) ### [`v0.13.4`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0134) [Compare Source](astral-sh/uv@0.13.3...0.13.4) Released on 2026-10-20. ##### Preview features - Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under `wheel-variants` ([#​22512](astral-sh/uv#22512)) ##### Other changes - Update the bundled Mozilla root certificates via `webpki-root-certs` 1.0.10 ([#​22760](astral-sh/uv#22760)) ### [`v0.13.3`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0133) [Compare Source](astral-sh/uv@0.13.2...0.13.3) Released on 2026-10-20. ##### Performance - Avoid severe `uv export` slowdowns in dependency graphs with extras ([#​22750](astral-sh/uv#22750)) ### [`v0.13.2`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0132) [Compare Source](astral-sh/uv@0.13.1...0.13.2) Released on 2026-10-19. ##### Enhancements - Report all installed packages in `uv workspace metadata`, including packages outside the selected resolution ([#​22395](astral-sh/uv#22395)) - Include supported environment restrictions when exporting `pylock.toml` ([#​22596](astral-sh/uv#22596)) - Retry dropped GET and HEAD requests when fetching package and index data ([#​22672](astral-sh/uv#22672)) - Preserve encoding declarations in wheel data scripts that require shell launchers ([#​22526](astral-sh/uv#22526)) - Show causes and hints when `uv python find --script` cannot discover an interpreter, including with `-q` ([#​22549](astral-sh/uv#22549)) - Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh ([#​22538](astral-sh/uv#22538), [#​22572](astral-sh/uv#22572)) - Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's `[build-system].requires` validation ([#​22577](astral-sh/uv#22577)) ##### Python - Add PyPy 3.11.17 and 3.12.15 ([#​22578](astral-sh/uv#22578)) ##### Preview features - Fetch and parse PEP 825 index-level variant metadata with `wheel-variants` ([#​22509](astral-sh/uv#22509), [#​22511](astral-sh/uv#22511)) ##### Performance - Avoid exponential work when simplifying, traversing, and exporting complex dependency markers ([#​22608](astral-sh/uv#22608), [#​22615](astral-sh/uv#22615), [#​22651](astral-sh/uv#22651), [#​22674](astral-sh/uv#22674)) - Reduce the time and memory used to parse and store complex dependency markers ([#​22675](astral-sh/uv#22675), [#​22676](astral-sh/uv#22676), [#​22681](astral-sh/uv#22681)) - Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups ([#​22565](astral-sh/uv#22565), [#​22625](astral-sh/uv#22625)) - Speed up project discovery in large workspaces by caching member names ([#​22635](astral-sh/uv#22635)) - Reduce uv's binary size and speed up CycloneDX exports ([#​22431](astral-sh/uv#22431)) - Reduce `uv-build` binary size, including Linux x86_64 wheels ([#​22539](astral-sh/uv#22539), [#​22573](astral-sh/uv#22573)) - Reduce allocations when parsing TOML ([#​22679](astral-sh/uv#22679)) ##### Bug fixes - Respect `--exclude-newer` when a newer wheel for the selected source distribution is already cached ([#​22685](astral-sh/uv#22685)) - Prevent URL credentials from leaking through diagnostics or persisted metadata ([#​22600](astral-sh/uv#22600), [#​22601](astral-sh/uv#22601), [#​22617](astral-sh/uv#22617), [#​22622](astral-sh/uv#22622), [#​22646](astral-sh/uv#22646)) - Keep separate cache entries for signed `--find-links` URLs that differ only in sensitive query values ([#​22630](astral-sh/uv#22630)) - Honor PEP 751 environment restrictions when installing or syncing from `pylock.toml` ([#​22594](astral-sh/uv#22594)) - Use configured credentials before prompting during `uv publish`, and avoid prompting when no upload occurs ([#​22593](astral-sh/uv#22593)) - Match recursive build globs against complete file paths and ignore invalid license symlinks ([#​22581](astral-sh/uv#22581), [#​22583](astral-sh/uv#22583)) - Return an error for invalid `uv pip compile --python-version` values instead of panicking ([#​22727](astral-sh/uv#22727)) - Reject invalid `pylock.toml` output filenames before resolution instead of panicking ([#​22725](astral-sh/uv#22725)) - Avoid panicking during repeated resolution conflicts involving fixed-priority packages ([#​22589](astral-sh/uv#22589)) - Create version aliases correctly when installing managed Python into a relative directory ([#​22547](astral-sh/uv#22547)) - Show incompatibilities from failing `uv pip check` invocations with `-q` ([#​22544](astral-sh/uv#22544)) - Treat logically equivalent dependency markers as equal regardless of construction order ([#​22680](astral-sh/uv#22680)) ##### Rust API - Require the opt-in `unsafe-url` feature to use raw `url::Url` APIs in `uv-pep508` ([#​22623](astral-sh/uv#22623)) ##### Documentation - Clarify credential lookup, environment synchronization, managed Python, and integration guidance ([#​22542](astral-sh/uv#22542)) ##### Other changes - Use stable `sh.astral.*` signing identifiers for macOS binaries ([#​22648](astral-sh/uv#22648)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjAuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==--> Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/81 Reviewed-by: Luke Tainton <luke@tainton.uk> Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
Automated mise tool upgrades from local config.
mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator aube
editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (5 tools)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `pinact` | `5.0.0` → `5.0.1` | `5.0.0` → `5.0.1` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |
</details>
<details>
<summary>Release notes (5 tools)</summary>
<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>
### v2.3.0
jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.
## Added
- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @jdx)
```yaml
ignores:
- rule: unpinned-uses
uses: actions/cache
reason: pinned by the Actions lock file on some branches
allow-unused: true
```
## Fixed
- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@jdalton)
## New Contributors
* @jdalton made their first contribution in #292
**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0
## 💚 Sponsor jactionlint
jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)
</details>
<details>
<summary>pinact: `5.0.0` → `5.0.1` (suzuki-shunsuke/pinact)</summary>
### v5.0.1
suzuki-shunsuke/pinact@v5.0.0...v5.0.1
## ⚠️ Security
#1792 Update Go to v1.27.3
This release is built with Go 1.27.3, which fixes
[CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now
refuses trust in a small set of intermediate certificates of a specific
Certificate Authority, after its CA keys were reported compromised.
`Verify` filters out chains containing those intermediates. The Go team
highly recommends upgrading immediately.
pinact relies on `crypto/x509` to verify the TLS certificate of GitHub
when it calls the GitHub API, with your access token if one is set, to
resolve the commit SHAs that workflows are pinned to. We recommend
upgrading.
ref.
- https://go.dev/doc/devel/release#go1.27.3
-
https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
This release also includes Go 1.27.2 (#1764), which has security fixes
to the `go` command and the `crypto/tls`, `html/template`, `net/http`,
`net/textproto`, and `os` packages.
- https://go.dev/doc/devel/release#go1.27.2
## Others
#1766 ci: Update GitHub Actions runner to ubuntu-26.04
#1767 ci: Use download-go-module-action
#1768 ci: Share Go modules between integration test and
go-test-full-workflow
#1774 ci: Use the reusable workflow of go-autofix-action
#1782 ci: Replace go-test-full-workflow with go-test-workflow and
test-workflow
## Dependency updates
#1764 #1792 Update Go to v1.27.3
#1730 #1789 Update github.com/google/go-github to v93
#1739 Update github.com/suzuki-shunsuke/cobra-util to v0.0.5
#1723 Update github.com/sourcegraph/go-diff to v0.9.0
</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>
### v0.5.6
## Release Notes
Released on 2026-10-19.
### Enhancements
- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))
### Performance
- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))
### Bug fixes
- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))
### Documentation
- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))
### Other changes
- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))
### Contributors
- @ebuildy
- @j178
- @shaanmajid
## Install prek 0.5.6
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.6
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)
### v0.5.7
## Release Notes
Released on 2026-10-21.
### Enhancements
- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))
### Performance
- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))
### Other changes
- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))
### Contributors
- @shaanmajid
- @j178
## Install prek 0.5.7
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.7
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)
</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>
### v1.8.8
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->
## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @ya7010 in
tombi-toml/tombi#2328
**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8
### v1.8.9
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->
## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @ya7010 in
tombi-toml/tombi#2332
## New Contributors
* @JounQin made their first contribution in
tombi-toml/tombi#2330
**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9
### v1.8.10
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->
## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @ya7010 in
tombi-toml/tombi#2347
**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10
### v1.9.0
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->
## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @ya7010 in
tombi-toml/tombi#2349
**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0
### v1.9.1
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->
## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @ya7010 in
tombi-toml/tombi#2353
**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1
</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>
### 0.13.2
## Release Notes
Released on 2026-10-19.
### Enhancements
- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))
### Python
- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))
### Preview features
- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))
### Performance
- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)
### 0.13.3
## Release Notes
Released on 2026-10-20.
### Performance
- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))
## Install uv 0.13.3
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```
## Download uv 0.13.3
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)
### 0.13.4
## Release Notes
Released on 2026-10-20.
This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.
### Preview features
- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))
### Other changes
- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))
## Install uv 0.13.4
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```
## Download uv 0.13.4
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)
### 0.13.5
## Release Notes
Released on 2026-10-21.
Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.
Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.
### Enhancements
- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))
### Python
- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))
### Preview features
- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)
</details>
</details>
Modified files:
- `.mise.toml`
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary> ### 0.13.2 ## Release Notes Released on 2026-10-19. ### Enhancements - Report all installed packages in `uv workspace metadata`, including packages outside the selected resolution ([#22395](astral-sh/uv#22395)) - Include supported environment restrictions when exporting `pylock.toml` ([#22596](astral-sh/uv#22596)) - Retry dropped GET and HEAD requests when fetching package and index data ([#22672](astral-sh/uv#22672)) - Preserve encoding declarations in wheel data scripts that require shell launchers ([#22526](astral-sh/uv#22526)) - Show causes and hints when `uv python find --script` cannot discover an interpreter, including with `-q` ([#22549](astral-sh/uv#22549)) - Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh ([#22538](astral-sh/uv#22538), [#22572](astral-sh/uv#22572)) - Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's `[build-system].requires` validation ([#22577](astral-sh/uv#22577)) ### Python - Add PyPy 3.11.17 and 3.12.15 ([#22578](astral-sh/uv#22578)) ### Preview features - Fetch and parse PEP 825 index-level variant metadata with `wheel-variants` ([#22509](astral-sh/uv#22509), [#22511](astral-sh/uv#22511)) ### Performance - Avoid exponential work when simplifying, traversing, and exporting complex dependency markers ([#22608](astral-sh/uv#22608), [#22615](astral-sh/uv#22615), [#22651](astral-sh/uv#22651), [#22674](astral-sh/uv#22674)) - Reduce the time and memory used to parse and store complex dependency markers ([#22675](astral-sh/uv#22675), [#22676](https://gith… (truncated) ### 0.13.3 ## Release Notes Released on 2026-10-20. ### Performance - Avoid severe `uv export` slowdowns in dependency graphs with extras ([#22750](astral-sh/uv#22750)) ## Install uv 0.13.3 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex" ``` ## Download uv 0.13.3 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux… (truncated) ### 0.13.4 ## Release Notes Released on 2026-10-20. This release addresses [GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62), which involves a root CA whose intermediate on the Web PKI have been compromised. Users are encouraged to upgrade immediately, as well as confirm that all other software that uses bundled CAs is also properly updated. ### Preview features - Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under `wheel-variants` ([#22512](astral-sh/uv#22512)) ### Other changes - Update the bundled Mozilla root certificates via `webpki-root-certs` 1.0.10 ([#22760](astral-sh/uv#22760)) ## Install uv 0.13.4 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex" ``` ## Download uv 0.13.4 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/downloa… (truncated) ### 0.13.5 ## Release Notes Released on 2026-10-21. Following [uv 0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to [python-build-standalone 20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021), including the CPython [3.15.1](https://www.python.org/downloads/release/python-3151/), [3.14.9](https://www.python.org/downloads/release/python-3149/), and [3.13.17](https://www.python.org/downloads/release/python-31317/) security patch releases. These builds include [pip 26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled in the managed interpreter and bundled with `ensurepip`, which installs pip by default when you run `python -m venv`. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run `uv python upgrade` to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments. Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions. ### Enhancements - Report incompatible self-dependencies directly in resolution errors ([#21845](astral-sh/uv#21845)) ### Python - Add CPython 3.15.1, 3.14.9, and 3.13.17 ([#22802](astral-sh/uv#22802)) ### Preview features - Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with `wheel-variants` ([#22535](astral-sh/uv#22535), [#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config.
mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (4 tools)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |
</details>
<details>
<summary>Release notes (4 tools)</summary>
<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>
### v2.3.0
jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.
## Added
- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @jdx)
```yaml
ignores:
- rule: unpinned-uses
uses: actions/cache
reason: pinned by the Actions lock file on some branches
allow-unused: true
```
## Fixed
- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@jdalton)
## New Contributors
* @jdalton made their first contribution in #292
**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0
## 💚 Sponsor jactionlint
jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)
</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>
### v0.5.6
## Release Notes
Released on 2026-10-19.
### Enhancements
- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))
### Performance
- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))
### Bug fixes
- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))
### Documentation
- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))
### Other changes
- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))
### Contributors
- @ebuildy
- @j178
- @shaanmajid
## Install prek 0.5.6
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.6
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)
### v0.5.7
## Release Notes
Released on 2026-10-21.
### Enhancements
- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))
### Performance
- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))
### Other changes
- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))
### Contributors
- @shaanmajid
- @j178
## Install prek 0.5.7
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.7
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)
</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>
### v1.8.8
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->
## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @ya7010 in
tombi-toml/tombi#2328
**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8
### v1.8.9
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->
## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @ya7010 in
tombi-toml/tombi#2332
## New Contributors
* @JounQin made their first contribution in
tombi-toml/tombi#2330
**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9
### v1.8.10
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->
## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @ya7010 in
tombi-toml/tombi#2347
**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10
### v1.9.0
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->
## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @ya7010 in
tombi-toml/tombi#2349
**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0
### v1.9.1
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->
## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @ya7010 in
tombi-toml/tombi#2353
**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1
</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>
### 0.13.2
## Release Notes
Released on 2026-10-19.
### Enhancements
- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))
### Python
- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))
### Preview features
- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))
### Performance
- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)
### 0.13.3
## Release Notes
Released on 2026-10-20.
### Performance
- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))
## Install uv 0.13.3
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```
## Download uv 0.13.3
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)
### 0.13.4
## Release Notes
Released on 2026-10-20.
This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.
### Preview features
- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))
### Other changes
- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))
## Install uv 0.13.4
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```
## Download uv 0.13.4
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)
### 0.13.5
## Release Notes
Released on 2026-10-21.
Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.
Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.
### Enhancements
- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))
### Python
- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))
### Preview features
- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)
</details>
</details>
Modified files:
- `.mise.toml`
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config.
mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (4 tools)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |
</details>
<details>
<summary>Release notes (4 tools)</summary>
<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>
### v2.3.0
jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.
## Added
- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @jdx)
```yaml
ignores:
- rule: unpinned-uses
uses: actions/cache
reason: pinned by the Actions lock file on some branches
allow-unused: true
```
## Fixed
- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@jdalton)
## New Contributors
* @jdalton made their first contribution in #292
**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0
## 💚 Sponsor jactionlint
jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)
</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>
### v0.5.6
## Release Notes
Released on 2026-10-19.
### Enhancements
- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))
### Performance
- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))
### Bug fixes
- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))
### Documentation
- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))
### Other changes
- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))
### Contributors
- @ebuildy
- @j178
- @shaanmajid
## Install prek 0.5.6
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.6
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)
### v0.5.7
## Release Notes
Released on 2026-10-21.
### Enhancements
- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))
### Performance
- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))
### Other changes
- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))
### Contributors
- @shaanmajid
- @j178
## Install prek 0.5.7
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.7
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)
</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>
### v1.8.8
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->
## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @ya7010 in
tombi-toml/tombi#2328
**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8
### v1.8.9
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->
## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @ya7010 in
tombi-toml/tombi#2332
## New Contributors
* @JounQin made their first contribution in
tombi-toml/tombi#2330
**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9
### v1.8.10
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->
## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @ya7010 in
tombi-toml/tombi#2347
**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10
### v1.9.0
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->
## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @ya7010 in
tombi-toml/tombi#2349
**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0
### v1.9.1
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->
## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @ya7010 in
tombi-toml/tombi#2353
**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1
</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>
### 0.13.2
## Release Notes
Released on 2026-10-19.
### Enhancements
- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))
### Python
- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))
### Preview features
- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))
### Performance
- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)
### 0.13.3
## Release Notes
Released on 2026-10-20.
### Performance
- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))
## Install uv 0.13.3
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```
## Download uv 0.13.3
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)
### 0.13.4
## Release Notes
Released on 2026-10-20.
This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.
### Preview features
- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))
### Other changes
- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))
## Install uv 0.13.4
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```
## Download uv 0.13.4
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)
### 0.13.5
## Release Notes
Released on 2026-10-21.
Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.
Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.
### Enhancements
- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))
### Python
- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))
### Preview features
- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)
</details>
</details>
Modified files:
- `.mise.toml`
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary> ### 0.13.2 ## Release Notes Released on 2026-10-19. ### Enhancements - Report all installed packages in `uv workspace metadata`, including packages outside the selected resolution ([#22395](astral-sh/uv#22395)) - Include supported environment restrictions when exporting `pylock.toml` ([#22596](astral-sh/uv#22596)) - Retry dropped GET and HEAD requests when fetching package and index data ([#22672](astral-sh/uv#22672)) - Preserve encoding declarations in wheel data scripts that require shell launchers ([#22526](astral-sh/uv#22526)) - Show causes and hints when `uv python find --script` cannot discover an interpreter, including with `-q` ([#22549](astral-sh/uv#22549)) - Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh ([#22538](astral-sh/uv#22538), [#22572](astral-sh/uv#22572)) - Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's `[build-system].requires` validation ([#22577](astral-sh/uv#22577)) ### Python - Add PyPy 3.11.17 and 3.12.15 ([#22578](astral-sh/uv#22578)) ### Preview features - Fetch and parse PEP 825 index-level variant metadata with `wheel-variants` ([#22509](astral-sh/uv#22509), [#22511](astral-sh/uv#22511)) ### Performance - Avoid exponential work when simplifying, traversing, and exporting complex dependency markers ([#22608](astral-sh/uv#22608), [#22615](astral-sh/uv#22615), [#22651](astral-sh/uv#22651), [#22674](astral-sh/uv#22674)) - Reduce the time and memory used to parse and store complex dependency markers ([#22675](astral-sh/uv#22675), [#22676](https://gith… (truncated) ### 0.13.3 ## Release Notes Released on 2026-10-20. ### Performance - Avoid severe `uv export` slowdowns in dependency graphs with extras ([#22750](astral-sh/uv#22750)) ## Install uv 0.13.3 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex" ``` ## Download uv 0.13.3 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux… (truncated) ### 0.13.4 ## Release Notes Released on 2026-10-20. This release addresses [GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62), which involves a root CA whose intermediate on the Web PKI have been compromised. Users are encouraged to upgrade immediately, as well as confirm that all other software that uses bundled CAs is also properly updated. ### Preview features - Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under `wheel-variants` ([#22512](astral-sh/uv#22512)) ### Other changes - Update the bundled Mozilla root certificates via `webpki-root-certs` 1.0.10 ([#22760](astral-sh/uv#22760)) ## Install uv 0.13.4 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex" ``` ## Download uv 0.13.4 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/downloa… (truncated) ### 0.13.5 ## Release Notes Released on 2026-10-21. Following [uv 0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to [python-build-standalone 20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021), including the CPython [3.15.1](https://www.python.org/downloads/release/python-3151/), [3.14.9](https://www.python.org/downloads/release/python-3149/), and [3.13.17](https://www.python.org/downloads/release/python-31317/) security patch releases. These builds include [pip 26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled in the managed interpreter and bundled with `ensurepip`, which installs pip by default when you run `python -m venv`. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run `uv python upgrade` to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments. Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions. ### Enhancements - Report incompatible self-dependencies directly in resolution errors ([#21845](astral-sh/uv#21845)) ### Python - Add CPython 3.15.1, 3.14.9, and 3.13.17 ([#22802](astral-sh/uv#22802)) ### Preview features - Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with `wheel-variants` ([#22535](astral-sh/uv#22535), [#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Summary
We decouple the build backend's parsing of
build-system.requiresfrom uv's supported installation sources. The build frontend resolves and installs these requirements before invoking the backend, so the backend should not enforce uv's Git transport or archive-format restrictions. We retain general requirement and URL parsing while removing distribution classification from this field, allowing the standaloneuv-buildbinary to omit Git parsing and archive-extension inference.This intentionally broadens acceptance. The backend now accepts Mercurial references such as
hg+https://example.com/repoand archive download URLs without a recognized filename extension. It also accepts strings such asgit+banana://example.com/repoandgit+://example.com/repothat parse as URLs but fail uv's Git URL validation. Acceptance by the backend does not establish that a requirement is installable; the frontend owns that check. uv's direct-build validation and project-dependency parsing retain their existing URL checks.In the Linux x86_64 comparison against
mainate37c1f0c6, using Rust 1.99.0 and the strippedminimal-sizeprofile,uv-buildshrank from 3,075,808 to 3,029,232 bytes (46,576 bytes, 1.51%). This subsumes the standalone-binary size saving from astral-sh#2753; the two savings are not additive.