[scality-renovate]

This PR contains the following updates:

Package	Update	Change	Pending
astral-sh/uv	patch	0.13.0 → 0.13.3	0.13.6 (+2)

---

Release Notes

astral-sh/uv

v0.13.3

Compare Source

Released on 2026-10-20.

Performance

• Avoid severe uv export slowdowns in dependency graphs with extras (#​22750)

v0.13.2

Compare Source

Released on 2026-10-19.

Enhancements

• Report all installed packages in uv workspace metadata, including packages outside the selected resolution (#​22395)
• Include supported environment restrictions when exporting pylock.toml (#​22596)
• Retry dropped GET and HEAD requests when fetching package and index data (#​22672)
• Preserve encoding declarations in wheel data scripts that require shell launchers (#​22526)
• Show causes and hints when uv python find --script cannot discover an interpreter, including with -q (#​22549)
• Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh (#​22538, #​22572)
• Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's [build-system].requires validation (#​22577)

Python

• Add PyPy 3.11.17 and 3.12.15 (#​22578)

Preview features

• Fetch and parse PEP 825 index-level variant metadata with wheel-variants (#​22509, #​22511)

Performance

• Avoid exponential work when simplifying, traversing, and exporting complex dependency markers (#​22608, #​22615, #​22651, #​22674)
• Reduce the time and memory used to parse and store complex dependency markers (#​22675, #​22676, #​22681)
• Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups (#​22565, #​22625)
• Speed up project discovery in large workspaces by caching member names (#​22635)
• Reduce uv's binary size and speed up CycloneDX exports (#​22431)
• Reduce uv-build binary size, including Linux x86_64 wheels (#​22539, #​22573)
• Reduce allocations when parsing TOML (#​22679)

Bug fixes

• Respect --exclude-newer when a newer wheel for the selected source distribution is already cached (#​22685)
• Prevent URL credentials from leaking through diagnostics or persisted metadata (#​22600, #​22601, #​22617, #​22622, #​22646)
• Keep separate cache entries for signed --find-links URLs that differ only in sensitive query values (#​22630)
• Honor PEP 751 environment restrictions when installing or syncing from pylock.toml (#​22594)
• Use configured credentials before prompting during uv publish, and avoid prompting when no upload occurs (#​22593)
• Match recursive build globs against complete file paths and ignore invalid license symlinks (#​22581, #​22583)
• Return an error for invalid uv pip compile --python-version values instead of panicking (#​22727)
• Reject invalid pylock.toml output filenames before resolution instead of panicking (#​22725)
• Avoid panicking during repeated resolution conflicts involving fixed-priority packages (#​22589)
• Create version aliases correctly when installing managed Python into a relative directory (#​22547)
• Show incompatibilities from failing uv pip check invocations with -q (#​22544)
• Treat logically equivalent dependency markers as equal regardless of construction order (#​22680)

Rust API

• Require the opt-in unsafe-url feature to use raw url::Url APIs in uv-pep508 (#​22623)

Documentation

• Clarify credential lookup, environment synchronization, managed Python, and integration guidance (#​22542)

Other changes

• Use stable sh.astral.* signing identifiers for macOS binaries (#​22648)

v0.13.1

Compare Source

Released on 2026-10-14.

Enhancements

• Ignore Requires-Python upper bounds in uv pip check and uv pip install --strict, consistent with resolution (#​22500)
• Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable (#​22463)
• Report missing trusted hashes in resolution errors (#​22241)

Python

• Add CPython 3.16.0a1 (#​22527)

Preview features

• Allow uv tool upgrade to upgrade installed tools when tool-install-locks is enabled (#​22498)
• Add preliminary support for parsing PEP 825 variant labels in wheel filenames with wheel-variants (#​22039)

Performance

• Reduce uv's binary size (#​22429, #​22430, #​22432)
• Speed up Simple API parsing (#​22429)
• Reduce package metadata parsing overhead (#​22239)

Bug fixes

• Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories (#​22495)
• Restore support for source distributions containing hard links or full-length tar user or group names (#​22516, #​22522)
• Preserve device files and FIFOs used as uv pip compile or uv export output destinations (#​22496)
• Fix sys._base_executable detection for environments created from symlinked interpreters (#​22520)
• Prevent concurrent readers from observing partially written lockfiles, Python version files, or managed Python sysconfig files (#​22399, #​22402, #​22403)
• Serialize concurrent project commands that reach the same environment through real and symlinked paths (#​22390)
• Prevent installs, syncs, and environment creation from failing when they race with uv cache clean (#​22387)
• Prevent concurrent tool installations from corrupting an environment when the last tool is uninstalled (#​22391)
• Persist changed upgrade settings even when uv tool upgrade leaves the tool version unchanged (#​22499)
• Reuse environments with installed Git dependencies pinned to full commit hashes without resolving again (#​22464)

Documentation

• Explain how to select an emulated Python interpreter on Windows ARM64 when native wheels are unavailable (#​22424)
• Fix the .netrc format documentation link (#​22514)

Other changes

• Publish Python 3.15-based uv Docker images under stable tags (#​22503)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.