build(deps-dev): update uv-build requirement from <0.13,>=0.12.7 to >=0.12.9,<0.13

[dependabot]

Updates the requirements on uv-build to permit the latest version.

Release notes

Sourced from uv-build's releases.

0.12.9

Release Notes

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#21413, #21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
• Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

Install uv 0.12.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex"

Download uv 0.12.9

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.12.9

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#21413, #21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
• Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

0.12.8

Released on 2026-08-31.

Enhancements

• Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

• Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
• Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
• Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

• Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
• Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
• Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
• Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

• Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
• Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)

... (truncated)

Commits

• 9f92860 Bump version to 0.12.9 (#21422)
• 29c5462 Skip invalid scripts in uv workspace list --scripts (#21416)
• bf1d7e8 Encapsulate wheel extraction directory ownership (#21419)
• 6dacee0 Run streaming ZIP extraction in a blocking task (#21372)
• 91d1ebf Sync latest Python releases (#21415)
• 6a61ddb Revert "Limit CI planner checkout depth" (#21414)
• e9d1816 Add CPython 3.15.0rc2 (#21413)
• e888329 Remove unreachable lock configuration sources (#21409)
• bf041f9 Allow negating locked and frozen modes (#21408)
• feffc0b Bump async_http_range_reader to 0.11.1 (#21401)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automerge, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[OnlineChef (ChefGroep)]

Reviewed exact head e17038e. Change is limited to raising the uv_build lower bound from 0.12.7 to 0.12.9 and updating the matching regression assertion. Exact-head CI, no-org-leak, design-system contract, and automerge workflow are green; no unresolved review threads.